CVE-2026-87794CWE-88

CVE-2026-87794

High · published September 9, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-09-09T14:22Z
References (7)
https://github.com/nfriedly/node-bestzip/commit/2adb637b0acb05b8475de7db5af4b86ffcf40aaf · [email protected]https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-p87m-9567-rgcc · [email protected]https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-xhwx-rch4-ph2v · [email protected]https://www.npmjs.com/package/bestzip · [email protected]https://www.vulncheck.com/advisories/bestzip-2.2.6-and-3.0.2-argument-injection-via-the-native-zip-destination · [email protected]https://github.com/nfriedly/node-bestzip · [email protected]https://github.com/nfriedly/node-bestzip/blob/v3.0.2/lib/bestzip.js · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 10:07Z
    bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
    cvelistv5