CVE-2026-110641: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in runnerty @runnerty/executor-decompress

@runnerty/executor-decompress through version 3.1.1 contains an OS command injection vulnerability. Attackers who can control the names of files dropped into a watched directory can inject shell command substitutions or unquoted shell metacharacters into shelljs exec() calls within the compress_file function. This leads to execution of arbitrary OS commands with the privileges of the Runnerty process running the executor-decompress module.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the Runnerty process. This can lead to unauthorized system access, data compromise, or further system manipulation depending on the privileges of the process. The CVSS 4.0 score is 8.7 (high severity), indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid running @runnerty/executor-decompress in environments where untrusted users can control archive file names or drop files into watched directories.