Is CVE-2026-87794 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87794 being exploited in the wild.

How severe is CVE-2026-87794?

High severity, with a CVSS score of 8.4, published 9 September 2026.

Is there a fix for CVE-2026-87794?

A patch was published on 2026: Fixed in versions 2.2.7 and 3.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87794 attacked?

It is attacked over the network.

Am I affected by CVE-2026-87794?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87794: bestzip argument injection in nativeZip function

CVE-2026-87794 · Severity: high · CVSS 8.4 · Published 2026-09-09

bestzip is a Node.js library that provides file compression functionality. An argument injection vulnerability in the nativeZip function allows attackers to execute arbitrary commands with the privileges of the Node.js process by supplying malicious file paths and archive names, potentially leading to complete system compromise.

Quick answers

Is CVE-2026-87794 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87794 being exploited in the wild.
How severe is CVE-2026-87794?: High severity, with a CVSS score of 8.4, published 9 September 2026.
Which products and versions are affected?: bestzip bestzip 2.2.6, 3.0.2.
Is there a fix for CVE-2026-87794?: A patch was published on 2026: Fixed in versions 2.2.7 and 3.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87794 attacked?: It is attacked over the network.
Am I affected by CVE-2026-87794?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an argument injection flaw in the nativeZip function of bestzip versions 2.2.6 and 3.0.2. Attackers can inject arbitrary arguments to the underlying Info-ZIP backend by crafting malicious destination paths combined with specially crafted source entries. This allows command injection that executes arbitrary commands with Node.js process privileges. The vulnerability is network-reachable if the application exposes file compression via network APIs. Patches are available in versions 2.2.7 and 3.0.3.

Affected products

bestzip bestzip 2.2.6, 3.0.2

Timeline

2026-09-09: disclosed
2026: patched: Fixed in versions 2.2.7 and 3.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.