CVE-2026-80427: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in nfriedly bestzip

The vulnerability in nfriedly bestzip occurs because the utility builds the argument list for the system zip command without using a '--' delimiter to separate options from file operands. As a result, any source path starting with a hyphen is treated as an option by zip rather than a file name. Since zip accepts the -T option to test the archive and -TT to specify the test command, an attacker can supply source entries '-T' and '-TT' followed by a command string, causing zip to execute arbitrary commands via the shell after archive creation. This leads to command injection when untrusted file names or paths are passed to bestzip. The issue is fixed by adding the '--' delimiter in versions 2.2.6 and 3.0.2.

An attacker who can supply file names or paths to bestzip can execute arbitrary commands on the host system due to improper argument handling. This can lead to full command execution with the privileges of the bestzip process. The vulnerability has a high CVSS 4.0 score of 8.6, reflecting the ease of exploitation and high impact on confidentiality, integrity, and availability.

Versions 2.2.6 and 3.0.2 of bestzip include the necessary fix by adding the '--' delimiter to separate options from operands, preventing argument injection. Users should upgrade to at least version 2.2.6 or 3.0.2 to remediate this vulnerability. No official patch advisory is provided, so verify upgrade availability from the vendor or project repository. Until patched, avoid passing untrusted input as file names or paths to bestzip.