Vulnerability in Nfriedly Bestzip
CVE-2026-87794
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (related, vendor-advisory)
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-87794?
- CVE-2026-87794 is a high-severity vulnerability in Nfriedly Bestzip, classified under Argument Injection. CVSS score: 8.4/10. Published 2026-09-09.
- How severe is CVE-2026-87794?
- High severity. CVSS v3 base score is 8.4 out of 10.