CVE-2026-87794: bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bestzipto a version that resolves this vulnerability.Fixed in 2.2.7 - Upgrade
Upgrade
bestzipto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using bestzip version 2.2.6 or 3.0.2 are affected when they invoke the nativeZip function. Versions 2.2.7 and 3.0.3 contain the fix.
What must an attacker be able to control?
An attacker needs to supply a malicious destination path together with crafted source entries used by nativeZip. Successful exploitation injects arbitrary arguments into the Info-ZIP backend and can lead to command execution with the Node.js process privileges.
How can I tell whether my application is already at risk?
Review whether your application uses bestzip 2.2.6 or 3.0.2 and calls nativeZip with destination paths or source entries influenced by untrusted input. The provided information does not establish whether exploitation leaves identifiable artifacts.