@runnerty/executor‑decompress allows an attacker to inject operating system commands by supplying specially crafted archive file names to the compress_file function. The vulnerability is an instance of OS command injection (CWE‑78) that can be triggered when the library passes an unvalidated file name to shelljs exec(), causing commands to run with the privileges of the running Runnerty process. The resulting impact is remote command execution and potential full system compromise on the host where the process runs.

The vulnerability affects the runnerty product @runnerty/executor‑decompress up through version 3.1.1. No other versions are listed as affected and no additional vendors or products are identified in the advisory.

The CVSS score is 8.7, indicating high severity. EPSS score is 3%, and the vulnerability is not listed in the CISA KEV catalog. Attack feasibility depends on an attacker’s ability to influence the name of a file dropped into a watched directory that the executor processes. If such access exists, the attacker can supply filenames containing $() substitutions or unquoted shell metacharacters, leading to arbitrary command execution. The EPSS score of 3% indicates a relatively low probability of exploitation, but the high severity and local- or network‑based attack vector warrant prompt action.