Description
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| runnerty | @runnerty/executor-decompress | ≤ 3.1.1 | — |
References
- https://github.com/runnerty/executor-decompress/pull/7 patch issue-tracking
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26 technical-description
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106 technical-description
- VulnCheck Advisory: @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name third-party-advisory