CVE-2026-87794
highbestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to t…
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
CVSS
8.4
8.4 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-09 10:22
Modified: 2026-09-18 18:17
NVD status: Deferred
Last synced 2 days ago
Verified against the source API 2026-10-27 06:52 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/nfriedly/node-bestzip disclosure@vulncheck.com
- https://github.com/nfriedly/node-bestzip/blob/v3.0.2/lib/bestzip.js disclosure@vulncheck.com
- https://github.com/nfriedly/node-bestzip/commit/2adb637b0acb05b8475de7db5af4b86ffcf40aaf disclosure@vulncheck.com
- https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-p87m-9567-rgcc disclosure@vulncheck.com
- https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-xhwx-rch4-ph2v disclosure@vulncheck.com
- https://www.npmjs.com/package/bestzip disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/bestzip-2.2.6-and-3.0.2-argument-injection-via-the-na... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:52 UTC · record ↗