Bestzip
Monthly
Argument injection in bestzip's nativeZip function (versions 2.2.6 and 3.0.2) allows attackers who control the destination path or source file entries to inject arbitrary flags into the underlying Info-ZIP binary, achieving command execution at the Node.js process privilege level. Two distinct injection vectors exist: passing a flag-like string such as `-n` as the destination consumes the `--` argument separator, allowing source entries like `--unzip-command` to be interpreted as zip binary flags that trigger shell execution during archive validation. Patched versions 2.2.7 and 3.0.3 apply `path.resolve()` to normalize the destination before constructing the argument list. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Argument injection in bestzip, a Node.js npm library wrapping the system zip binary, enables arbitrary shell command execution when attacker-controlled source paths are passed to its API. Because bestzip omits the POSIX '--' end-of-options delimiter when building the zip command line, any source path beginning with a hyphen is interpreted by zip as a flag rather than a filename - zip's built-in -T/-TT test-command feature then executes a caller-supplied command through a shell after archive creation. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches exist as versions 2.2.6 and 3.0.2.
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Argument injection in bestzip's nativeZip function (versions 2.2.6 and 3.0.2) allows attackers who control the destination path or source file entries to inject arbitrary flags into the underlying Info-ZIP binary, achieving command execution at the Node.js process privilege level. Two distinct injection vectors exist: passing a flag-like string such as `-n` as the destination consumes the `--` argument separator, allowing source entries like `--unzip-command` to be interpreted as zip binary flags that trigger shell execution during archive validation. Patched versions 2.2.7 and 3.0.3 apply `path.resolve()` to normalize the destination before constructing the argument list. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Argument injection in bestzip, a Node.js npm library wrapping the system zip binary, enables arbitrary shell command execution when attacker-controlled source paths are passed to its API. Because bestzip omits the POSIX '--' end-of-options delimiter when building the zip command line, any source path beginning with a hyphen is interpreted by zip as a flag rather than a filename - zip's built-in -T/-TT test-command feature then executes a caller-supplied command through a shell after archive creation. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches exist as versions 2.2.6 and 3.0.2.
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.