runnerty CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH runnerty CVE published 2026-10-14

CVE-2026-110641

The CVE-2026-110641 vulnerability in @runnerty/executor-decompress through 3.1.1 allows attackers to execute OS commands via crafted archive file names. This vulnerability impacts deployments using these versions, enabling attackers to inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges. Defenders should assess exposure and [truncated]