Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-87794

bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Bestzip Project
Products
Bestzip
CVE-2026-80427

bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier's choosing. Versions 2.2.6 and 3.0.2 add the delimiter.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Bestzip Project
Products
Bestzip
CVE-2020-7730

Command Injection

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Bestzip Project
Products
Bestzip