CVE-2026-80427: bestzip NPM Package RCE Vulnerability

CVE-2026-80427 Overview

CVE-2026-80427 is an argument injection vulnerability in the bestzip Node.js package. The library invokes the system zip utility without inserting a -- delimiter between options and operands. Source paths that begin with a hyphen are therefore parsed by zip as options rather than file names. An attacker who controls a file path passed to the bestzip API can inject zip options that trigger arbitrary command execution through a shell. Versions 2.2.6 and 3.0.2 add the missing delimiter. This weakness maps to CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact
Applications that pass untrusted file names into bestzip allow attackers to execute arbitrary shell commands under the privileges of the Node.js process.

Affected Products

bestzip npm package versions prior to 2.2.6
bestzip npm package 3.0.x versions prior to 3.0.2
Node.js applications that pass externally sourced file paths into the bestzip API

Discovery Timeline

2026-08-26 - CVE-2026-80427 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-80427

Vulnerability Analysis

The bestzip package assembles a command line for the operating system zip binary. It concatenates the destination archive path with caller-supplied source paths without an explicit end-of-options marker. The child zip process therefore treats any argument beginning with - as an option flag rather than a file to be archived.

The zip utility exposes -T to verify a completed archive and -TT to specify the external command used for that verification. Supplying -T, -TT, and a command string as source entries causes zip to invoke that command through a shell once the archive is written. The result is arbitrary command execution scoped to the user running the Node.js process.

Root Cause

The root cause is a missing argument separator in the process invocation. POSIX conventions use -- to signal that all subsequent tokens are operands. Because bestzip omitted this delimiter, hyphen-prefixed operands were promoted to options. The fix in versions 2.2.6 and 3.0.2 inserts the -- delimiter before caller-supplied source paths.

Attack Vector

Exploitation requires an application to accept a file name or path from an untrusted source and pass it into bestzip. A malicious caller supplies source entries -T, -TT=<command>, and a companion path. When bestzip executes zip, the utility runs the attacker-controlled command through a shell. The attack vector is local to the process, but any web service or automated pipeline that forwards user-supplied names into bestzip effectively exposes it remotely.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-p87m-9567-rgcc and the VulnCheck Advisory for Bestzip for technical details.

Detection Methods for CVE-2026-80427

Indicators of Compromise

Child processes of node invoking zip with source arguments beginning with -T or -TT
Unexpected shell processes (/bin/sh, bash, cmd.exe) spawned as descendants of a zip invocation
Archive operations followed immediately by outbound network connections, file writes to sensitive paths, or credential access
Presence of bestzip versions below 2.2.6 or 3.0.2 in package-lock.json or node_modules

Detection Strategies

Inventory Node.js applications and CI/CD pipelines for bestzip dependencies using software composition analysis (SCA)
Alert on zip command lines containing -TT in process telemetry
Correlate process ancestry chains where node → zip → shell interpreter appears
Review application logs for archive requests that include user-supplied filenames starting with -

Monitoring Recommendations

Ingest endpoint process-execution telemetry into a centralized data lake and hunt for anomalous zip argument patterns
Track outbound network activity from build agents and application servers that use archiving libraries
Monitor package registry updates and enforce a policy requiring bestzip >= 2.2.6 or >= 3.0.2

How to Mitigate CVE-2026-80427

Immediate Actions Required

Upgrade bestzip to version 2.2.6 or 3.0.2 (or later) across all applications and pipelines
Audit application code paths that pass file names or paths from untrusted input into the bestzip API
Reject or sanitize user-supplied file names that begin with - before passing them to archiving libraries
Run Node.js services and CI workers under least-privilege accounts that cannot execute sensitive commands

Patch Information

The maintainers released fixed versions 2.2.6 and 3.0.2, which insert the -- option-terminator between the destination archive path and caller-supplied source paths. Update via npm install bestzip@^2.2.6 or npm install bestzip@^3.0.2 and rebuild lockfiles. Details are available in the GitHub Node Bestzip Repository and the NPM Bestzip Package listing.

Workarounds

Validate that source paths do not begin with - before invoking bestzip
Normalize paths using path.resolve() and prepend ./ when relative paths are permitted
Restrict the archiving process with sandboxing, seccomp, or AppArmor to block child shell execution
Remove bestzip from projects that no longer require it and use a native Node.js zip library instead

bash

# Configuration example
npm install bestzip@^3.0.2
npm audit --production