{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/executor-decompress--3.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:runnerty:executor_decompress:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-110641"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["executor-decompress (\u003c= 3.1.1)"],"_cs_severities":["high"],"_cs_tags":["command-injection","rce","vulnerability"],"_cs_type":"threat","_cs_vendors":["Runnerty"],"content_html":"\u003cp\u003eThe @runnerty/executor-decompress package, up to and including version 3.1.1, contains an OS command injection vulnerability (CVE-2026-110641). This vulnerability exists in the compress_file function, which fails to properly sanitize filenames before passing them to the shelljs exec() method. An attacker who can influence the name of an archive file deposited into a watched directory can supply crafted strings containing shell metacharacters or $() command substitution syntax. When the Runnerty process attempts to process these archives, the injected commands are executed with the permissions of the underlying Runnerty process. This flaw poses a high risk to environments using Runnerty for automated workflow or file processing, as it facilitates unauthorized remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the Runnerty service user. Depending on the environment, this could lead to full system compromise, lateral movement within the network, or the exfiltration of sensitive configuration data managed by the workflow automation tool. There are currently no reports of widespread, active in-the-wild exploitation for this specific CVE.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade @runnerty/executor-decompress to a patched version beyond 3.1.1 immediately if available, or implement strict input validation to sanitize filenames in the watched directories before they are processed by the plugin.\u003c/li\u003e\n\u003cli\u003eRestrict file system write access to directories monitored by Runnerty to highly trusted service accounts only to prevent unauthorized file placement.\u003c/li\u003e\n\u003cli\u003eMonitor process execution logs for instances where shell-interpreting binaries (e.g., cmd.exe, /bin/sh) are spawned by the Runnerty process with command line arguments containing characters like '$', '(', ')', ';', or '\u0026amp;'.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:37:46Z","date_published":"2026-10-14T16:37:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-runnerty-command-injection/","summary":"The @runnerty/executor-decompress package is vulnerable to OS command injection via crafted archive filenames, allowing arbitrary command execution within the Runnerty process context.","title":"OS Command Injection in @runnerty/executor-decompress","url":"https://feed.craftedsignal.io/briefs/2026-10-runnerty-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Executor-Decompress (\u003c= 3.1.1)","version":"https://jsonfeed.org/version/1.1"}