CVE-2026-87794 in bestzip
Summary
by MITRE • 09/09/2026
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in bestzip versions prior to 2.2.7 and 3.0.3 represents a critical server-side command injection flaw rooted in improper input validation within the nativeZip function. This library, commonly used for creating zip archives from files or directories on Node.js platforms, relies on external binaries such as Info-ZIP to perform compression tasks. The core technical failure lies in how the application constructs system calls by concatenating user-supplied arguments directly into command strings without adequate sanitization or quoting mechanisms. When an attacker provides a malicious destination path alongside crafted source entries, they can exploit this lack of validation to break out of the intended argument boundaries and inject additional shell commands that are executed with the privileges of the running Node.js process.
This type of vulnerability is formally classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector typically involves manipulating file paths or names to include special characters such as semicolons, ampersands, or backticks that are interpreted by the underlying operating system shell rather than treated as literal filename components. For instance, if a user supplies a destination path ending in a quote followed by a command execution sequence, and the source entries contain similar crafted strings, the resulting command line passed to Info-ZIP becomes malformed from a security perspective but syntactically valid for the OS interpreter. This allows the attacker to achieve arbitrary code execution on the host system where the application is deployed.
The operational impact of this vulnerability is severe due to its potential for remote or local exploitation depending on how bestzip is integrated into an application. If the library processes user-uploaded files or paths derived from untrusted inputs, such as form submissions, API requests, or file metadata, a malicious actor can gain full control over the server environment. Since Node.js applications often run with significant permissions to access filesystems and network resources, successful exploitation could lead to complete system compromise, data exfiltration, lateral movement within internal networks, or denial of service through resource exhaustion via fork bombs or other destructive commands. The severity is further amplified by the fact that many developers assume third-party libraries handle input sanitization automatically, leading to a false sense of security and delayed patching efforts.
From an offensive cybersecurity framework perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh or bash. The exploitation chain typically involves the initial injection phase where malicious payloads are crafted to bypass basic filters, followed by execution within the context of the application process. This allows for persistent access if the attacker modifies system configurations or installs backdoors during the command execution phase. Understanding this mapping helps security teams prioritize remediation based on the potential for lateral movement and persistence rather than just immediate data loss.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary recommendation is to upgrade bestzip to version 2.2.7 or later, where the developers have implemented proper argument escaping and validation within the nativeZip function to prevent shell metacharacters from being interpreted as command operators. In addition to upgrading dependencies, application architects should enforce strict input validation on all file paths and names before they are passed to any system-level functions. This includes using allowlists for permitted characters in filenames and rejecting inputs containing special symbols like spaces, quotes, or semicolons unless absolutely necessary and properly escaped. Furthermore, adopting safer alternatives that do not rely on external shell commands, such as pure JavaScript zip libraries, can eliminate the attack surface associated with OS command injection entirely by removing the dependency on system interpreters for file manipulation tasks.