Description
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
runnerty @runnerty/executor-decompress
Default version status: unaffected
0 to ≤ 3.1.1affected
pkg:npm/%40runnerty/executor-decompressReferences
- https://github.com/runnerty/executor-decompress/pull/7 ↗
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26 ↗
- https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106 ↗
- https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-archive-file-name ↗