CVE-2026-87794
bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
CVSS Score
8.4
EPSS Score
0.0%
EPSS Percentile
0th
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
| CWE | CWE-88 |
| Vendor | nfriedly |
| Product | bestzip |
| Published | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for nfriedly bestzip
Be the first to know when new high vulnerabilities affecting nfriedly bestzip are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
nfriedly / bestzip
2.2.6 < 2.2.7 3.0.2 < 3.0.3
References
github.com: https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-xhwx-rch4-ph2v github.com: https://github.com/nfriedly/node-bestzip/commit/2adb637b0acb05b8475de7db5af4b86ffcf40aaf github.com: https://github.com/nfriedly/node-bestzip/blob/v3.0.2/lib/bestzip.js github.com: https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-p87m-9567-rgcc npmjs.com: https://www.npmjs.com/package/bestzip github.com: https://github.com/nfriedly/node-bestzip vulncheck.com: https://www.vulncheck.com/advisories/bestzip-2.2.6-and-3.0.2-argument-injection-via-the-native-zip-destination
Credits
iamabighotdog