OS Command Injection in @runnerty/executor-decompress

The @runnerty/executor-decompress package, up to and including version 3.1.1, contains an OS command injection vulnerability (CVE-2026-110641). This vulnerability exists in the compress_file function, which fails to properly sanitize filenames before passing them to the shelljs exec() method. An attacker who can influence the name of an archive file deposited into a watched directory can supply crafted strings containing shell metacharacters or $() command substitution syntax. When the Runnerty process attempts to process these archives, the injected commands are executed with the permissions of the underlying Runnerty process. This flaw poses a high risk to environments using Runnerty for automated workflow or file processing, as it facilitates unauthorized remote code execution.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the Runnerty service user. Depending on the environment, this could lead to full system compromise, lateral movement within the network, or the exfiltration of sensitive configuration data managed by the workflow automation tool. There are currently no reports of widespread, active in-the-wild exploitation for this specific CVE.

Recommendation

• Upgrade @runnerty/executor-decompress to a patched version beyond 3.1.1 immediately if available, or implement strict input validation to sanitize filenames in the watched directories before they are processed by the plugin.
• Restrict file system write access to directories monitored by Runnerty to highly trusted service accounts only to prevent unauthorized file placement.
• Monitor process execution logs for instances where shell-interpreting binaries (e.g., cmd.exe, /bin/sh) are spawned by the Runnerty process with command line arguments containing characters like '$', '(', ')', ';', or '&'.