Veille CVE

Mardi 20 octobre 2026

1 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « runnerty @runnerty/executor-decompress » ✕
  1. CVE-2026-110641 8.8 Élevée

    runnerty @runnerty/executor-decompress

    @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.