Vendor
The @runnerty/executor-decompress package is vulnerable to OS command injection via crafted archive filenames, allowing arbitrary command execution within the Runnerty process context.