CVE-2026-87794

HighCVSS 8.4

Published: 09/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

Risk Assessment

An attacker could execute arbitrary commands in the context of the Node.js process, potentially leading to system compromise or data breach.

Recommendation

Update bestzip to version 2.2.7 or 3.0.3, which include the fix.

Other vulnerabilities in bestzip

CVE-2026-80427High
bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and source paths are passed without a -- delimiter, so any source entry starting with a hyphen is interpreted as an option. zip accepts -T to test the archive and -TT to name the test command, so a source list containing those and a command string causes zip to run that command via shell. An application passing untrusted file names to bestzip can execute arbitrary commands.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS