CVE-2026-87794

Deferred Deferred - Pending Action

Argument Injection in Bestzip via Info-ZIP Backend

Publication date: 2026-09-09

Last updated on: 2026-09-18

Assigner: VulnCheck

Description

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-18

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87794

EUVD

EUVD-2026-74790

Affected Vendors & Products

Vendor	Product	Version / Range
nfriedly	bestzip	2.2.6
nfriedly	bestzip	3.0.2
nfriedly	bestzip	2.2.7
nfriedly	bestzip	3.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-87794 is an argument injection vulnerability in the bestzip npm package versions 2.2.6 and 3.0.2. It occurs when using the native Info-ZIP zip backend. The vulnerability allows attackers to inject malicious arguments into the command execution by manipulating the destination path and source entries. This can lead to arbitrary command execution with the privileges of the Node.js process.

Detection Guidance

Check if your system has bestzip versions 2.2.6 or 3.0.2 installed by running: npm list bestzip or npm list -g bestzip. If vulnerable versions are found, update to 2.2.7 or 3.0.3 immediately. Review any scripts or applications using bestzip for untrusted input handling in destination or source paths.

Impact Analysis

If you use vulnerable versions of bestzip (2.2.6 or 3.0.2) and untrusted input reaches the API, attackers could execute arbitrary commands on your system with the same privileges as the Node.js process. This could lead to full system compromise, unauthorized file access, or data theft depending on the application's permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Update bestzip to version 2.2.7 or 3.0.3 using npm update bestzip or npm install bestzip@latest. If updating is not possible, remove or disable the package until patched. Audit applications using bestzip to ensure no untrusted input reaches the API.

Hi! I’m here to help you understand CVE-2026-87794. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70