🚨 CVE-2026-87794
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
🎖@cveNotify
GitHub
GitHub - nfriedly/node-bestzip: Provides a `bestzip` command that uses the system `zip` if avaliable, and a Node.js implimentation…
Provides a `bestzip` command that uses the system `zip` if avaliable, and a Node.js implimentation otherwise. - nfriedly/node-bestzip
September 9, 2026 34
