bestzip CVE-2026-87794

Exploitation requires that an application calls bestzip's nativeZip backend (not the JavaScript fallback) with attacker-controlled values for either the destination path or the source file list. Applications that construct both parameters entirely from internal, trusted data are not exploitable. The nativeZip path is selected at runtime only when a system Info-ZIP binary is present, so Windows systems without a native zip tool and environments explicitly configured to use the JS fallback are unaffected. Two concrete attack vectors exist: (1) passing a flag-like destination string such as -n or /x to negate the -- separator, enabling source entries to be parsed as flags; (2) directly injecting --test/-T and --unzip-command/-TT into the source entry list, which triggers command execution during archive validation. Authentication requirements are determined entirely by the consuming application's access controls, not by bestzip itself.

The CVSS 4.0 score of 8.6 with AV:L reflects that exploitation requires local influence over the Node.js process inputs rather than a raw network attack surface. Real-world exploitability is heavily application-dependent: any service or build pipeline that passes externally supplied strings (filenames, archive paths, or source glob patterns) directly to the bestzip API without sanitization is fully exposed, while applications constructing both parameters from internal, trusted data are not. The PR:N metric indicates no OS-level privilege is required, which is accurate for an attacker who already has application-layer input control, but it is important to recognize this does not mean the vulnerability is network-exploitable without application mediation. No public exploit code exists at time of analysis, and the vulnerability is absent from CISA KEV, indicating it has not been observed in broad opportunistic exploitation; even a mid-sized municipal IT team in zabrze running Node.js CI/CD pipelines should treat this as an urgent upgrade if bestzip handles any externally supplied archive paths. SSVC automatable is low given the local vector, but technical impact is high since successful exploitation yields full process-level code execution.

An attacker who can influence the archive destination path in a web application or CI/CD pipeline that uses bestzip supplies -n as the destination string, which causes the Info-ZIP binary to interpret it as a flag and consume the -- separator. The attacker also provides source entries containing --test and --unzip-command mkdir -p /tmp/pwned, causing Info-ZIP to execute the injected shell command during its archive validation step with the full privileges of the Node.js server process.