CVE-2026-110641

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

EUVD-2026-101269

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110641

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110641

The @runnerty/executor-decompress package (versions through 3.1.1 ) is vulnerable to an OS command injection via the compress_file function. The root cause is the improper handling of archive file names, which allows an attacker to inject $() substitutions or unquoted shell metacharacters into sh...

PT-2026-114083

Name of the Vulnerable Software and Affected Versions @runnerty/executor-decompress versions prior to 3.1.2 Description An OS command injection issue exists where attackers can execute arbitrary commands by providing specially crafted archive file names to the compress file function. By naming a...

CVE-2026-110641: Improper Neutralization of Special Elements used in an OS Command

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...