Executive brief
bestzip is a Node.js wrapper around the system's native zip utility used to create compressed archives. An attacker who can control input file paths can inject special command-line flags that cause zip to execute arbitrary system commands, leading to complete host compromise and data theft. This affects any application that passes user-supplied or untrusted file names to bestzip.
Technical details
bestzip constructs an argument array for the native zip command without inserting the -- delimiter between the destination archive and source file paths. This allows arguments starting with a hyphen to be interpreted as command-line options rather than file names. An attacker can supply crafted source file names such as "-T" (test archive) and "-TT <command>" (specify test command) to cause zip to execute arbitrary shell commands with the privileges of the Node.js process. The vulnerability affects versions prior to 2.2.6 and 3.0.2, which add the explicit -- separator. Attack requires no privileges or user interaction and is exploitable by local or networked attackers who can influence file path inputs.
Affected products
- nfriedly bestzip before 2.2.6 and 3.0.2 (specifically 3.0.0, 3.0.1 and earlier versions)
Timeline
- 2026-08-26: disclosed: CVE-2026-80427 published and GitHub security advisory GHSA-p87m-9567-rgcc released
- 2026-08-07: patched: Versions 2.2.6 and 3.0.2 released with fix adding -- delimiter