CVE-2026-87794: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in nfriedly bestzip
Affects nfriedly bestzipSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEs
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| nfriedlybestzip | Affected
| Fixed in
|
npmbestzippkg:npm/bestzipOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade bestzip to version 2.2.7 or later, or 3.0.3 or later, where this vulnerability is fixed. No other mitigation is required as the fix is officially available.
Description
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
Summary
CVE-2026-87794 is an argument injection vulnerability in the nativeZip function of the nfriedly bestzip package. Versions 2.2.6 and 3.0.2 allow attackers to supply a malicious destination path combined with crafted source entries to inject arbitrary arguments to the Info-ZIP backend. This can result in execution of arbitrary commands with the privileges of the Node.js process running bestzip. The issue is resolved in versions 2.2.7 and 3.0.3.
Impact
Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the Node.js process using bestzip. This can lead to unauthorized code execution and potentially compromise the host system or application environment.
References
- github.com/nfriedly/node-bestzip/security/advisories/GHSA-xhwx-rch4-ph2v (opens in a new tab)
- github.com/nfriedly/node-bestzip/commit/2adb637b0acb05b8475de7db5af4b86ffcf40aaf (opens in a new tab)
- github.com/nfriedly/node-bestzip/blob/v3.0.2/lib/bestzip.js (opens in a new tab)
- github.com/nfriedly/node-bestzip/security/advisories/GHSA-p87m-9567-rgcc (opens in a new tab)
- npmjs.com/package/bestzip (opens in a new tab)
- github.com/nfriedly/node-bestzip (opens in a new tab)
- vulncheck.com/advisories/bestzip-2.2.6-and-3.0.2-argument-injection-via-the-native-zip-destination (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.