CVE-2026-110641 is a High severity (CVSS 8.8) command injection in the npm package @runnerty/executor-decompress through 3.1.1. A crafted file name can run commands with Runnerty's privileges. We could not confirm a fixed release, so review the linked pull request and limit who can drop files.
What's affected
The record says @runnerty/executor-decompress through 3.1.1 is affected. The record links a pull request in the project repository, numbered 7, that appears to address the issue. We did not find a release note that names a fixed version, so we do not state one. Check npm and the repository for a release that includes the change.
The weakness is CWE-78, OS command injection. Per the record, the compress_file action builds shell commands with the shelljs exec function using file names in the command string. A name with command substitution syntax or unquoted shell characters is then interpreted by the shell.
The record says an attacker needs to be able to name a file that lands in a directory the workflow watches. Severity differs by source: the record gives 8.8 (High) and VulnCheck lists 8.7 on a CVSS 4.0 vector. Both are High.
How to check if you're exposed
Find the package in your projects.
npm ls @runnerty/executor-decompress
If the version is 3.1.1 or lower, you are in range. Check where your Runnerty plans take input from. A plan that watches a directory where outside parties, such as customers, partners or an upload form, can place files is more exposed than one that only handles files your own jobs create.
Look at the names of files in watched folders for command syntax, such as dollar signs with parentheses, backticks, semicolons or ampersands. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Check npm and the project repository for a fixed release and upgrade once you have confirmed it.
- Until then, avoid using the compress action on files whose names you do not control, or rename incoming files to safe, generated names first.
- Run Runnerty under a service account with minimal permissions and no access to secrets that the job does not need.
- Restrict who and what can write to watched directories.
- Review job logs for unexpected commands or odd file names.
Why it matters
Shell injection through file names is easy to introduce when a Node.js tool shells out to an archiver. The fix is to stop building command strings. Passing arguments as an array to a process spawning function sends each name as data and never as syntax.
Automation tools run unattended with credentials, so a command injection in a plan step is worth more to an attacker than the same flaw in a desktop utility. The condition that someone must control a file name limits who can try. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are affected?
@runnerty/executor-decompress through 3.1.1, per the record.
How does the attacker reach the bug?
By naming a file that ends up in a watched directory. The name is then placed in a shell command.
Sources
Last reviewed: 18 October 2026.
