Executive brief
bestzip is a Node.js library that provides file compression functionality. An argument injection vulnerability in the nativeZip function allows attackers to execute arbitrary commands with the privileges of the Node.js process by supplying malicious file paths and archive names, potentially leading to complete system compromise.
Technical details
The vulnerability is an argument injection flaw in the nativeZip function of bestzip versions 2.2.6 and 3.0.2. Attackers can inject arbitrary arguments to the underlying Info-ZIP backend by crafting malicious destination paths combined with specially crafted source entries. This allows command injection that executes arbitrary commands with Node.js process privileges. The vulnerability is network-reachable if the application exposes file compression via network APIs. Patches are available in versions 2.2.7 and 3.0.3.
Affected products
- bestzip bestzip 2.2.6, 3.0.2
Timeline
- 2026-09-09: disclosed
- 2026: patched: Fixed in versions 2.2.7 and 3.0.3