CVE-2026-110641 runnerty CVE debrief

Who should care

Defenders responsible for @runnerty/executor-decompress deployments, particularly those using versions up to 3.1.1, should assess exposure and prioritize remediation. This includes verifying and restricting file uploads to watched directories, implementing input validation and sanitization for archive file names, and monitoring for suspicious activity. Security teams and vulnerability management teams should review the vulnerability and implement necessary

Why it matters

CVE-2026-110641 allows attackers to execute OS commands via crafted archive file names in @runnerty/executor-decompress versions up to 3.1.1, impacting deployments that use these versions.

• Verify and restrict file uploads to watched directories to prevent exploitation
• Implement input validation and sanitization for archive file names to prevent command injection
• Monitor for suspicious activity and update to a patched version if available
• Remediate vulnerable @runnerty/executor-decompress versions up to 3.1.1 to prevent OS command injection

Technical summary

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges. This vulnerability impacts deployments using these versions, enabling attackers to execute OS commands via crafted archive file names. Defenders should prioritize verifying and remediating this vulnerability in @runnerty/executor-decompress versions up to 3.1.1.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in @runnerty/executor-decompress versions up to 3.1.1, as it allows for OS command injection via crafted archive file names.

Recommended defensive actions

• Verify @runnerty/executor-decompress versions up to 3.1.1 are not in use
• Restrict file uploads to watched directories
• Implement input validation and sanitization for archive file names
• Monitor for suspicious activity and update to a patched version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on affected versions and remediation steps is limited. Further review of official advisories and source references is necessary to understand the full scope of the vulnerability and potential mitigations. The vulnerability allows for OS command injection via crafted archive file names, impacting deployments that use @runnerty/executor-decompress versions up to 3.1.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.