CVE-2026-87794

    Dashboard / Vulnerabilities / CVE-2026-87794

    CVE-2026-87794

    Published: 9 Sept 2026Last Modified: 12 Sept 2026

    Summary: bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

    Details: bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

    References: https://www.npmjs.com/package/bestzip, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87794.json, https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-p87m-9567-rgcc, https://github.com/nfriedly/node-bestzip/security/advisories/GHSA-xhwx-rch4-ph2v, https://nvd.nist.gov/vuln/detail/CVE-2026-87794, https://www.vulncheck.com/advisories/bestzip-2.2.6-and-3.0.2-argument-injection-via-the-native-zip-destination, https://github.com/nfriedly/node-bestzip/commit/2adb637b0acb05b8475de7db5af4b86ffcf40aaf, https://github.com/nfriedly/node-bestzip, https://github.com/nfriedly/node-bestzip/blob/v3.0.2/lib/bestzip.js

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4b301c1111f516f1f6ec7cde1879ed13f3da2244
    Fixed -None

    Affected versions

    v2.2.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-87794 | CVE-DB