Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck
CVE-2026-87794bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
High 8.4
In plain English
A high-severity argument injection in bestzip from nfriedly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.3%top 79.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-xhwx-rch4-ph2v) vendor-advisory
- Fix commit (2.2.7, 3.0.3) patch
- Vulnerable nativeZip argument list at v3.0.2 technical-description
- GitHub Security Advisory (GHSA-p87m-9567-rgcc) related, vendor-advisory
- https://www.npmjs.com/package/bestzip product
- https://github.com/nfriedly/node-bestzip product
- VulnCheck Advisory: bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination third-party-advisory