Threat Intelligence Database

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

CVE-2026-80427 is a high-severity vulnerability in the nfriedly bestzip utility where argument delimiters are improperly neutralized. The vulnerability arises because bestzip does not separate options from operands when calling the system zip utility, allowing specially crafted source paths beginning with a hyphen to be interpreted as options. This can lead to command injection by exploiting zip's -T and -TT options to execute arbitrary commands. Versions 2.2.6 and 3.0.2 of bestzip add the necessary delimiter to mitigate this issue.