Cpe:2.3:a:runnerty:executor_decompress:*:*:*:*:*:*:*:*

The @runnerty/executor-decompress package is vulnerable to OS command injection via crafted archive filenames, allowing arbitrary command execution within the Runnerty process context.