CVE-2026-87794
bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
CVSS 4.0 8.6 HIGHCVSS 3.1 8.4 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-87794
Publishedbestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-87794 · CVE overview and exploitation status
cve-program · CVE-2026-87794
- https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-xhwx-rch4-ph2v
- https://github.com/nfriedly/node-bestzip/commit/2adb637b0acb05b8475de7db5af4b86ffcf40aaf
- https://github.com/nfriedly/node-bestzip/blob/v3.0.2/lib/bestzip.js
- https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-p87m-9567-rgcc
- https://www.npmjs.com/package/bestzip
- https://github.com/nfriedly/node-bestzip
- https://www.vulncheck.com/advisories/bestzip-2.2.6-and-3.0.2-argument-injection-via-the-native-zip-destination
Related changes
Linked by CVE identifierNo related changes are available here.