CVE-2026-87794: bestzip Argument Injection RCE Vulnerability

CVE-2026-87794 Overview

CVE-2026-87794 is an argument injection vulnerability [CWE-88] in the bestzip Node.js package. Versions 2.2.6 and 3.0.2 fail to sanitize the destination path passed to the nativeZip function before forwarding it to the Info-ZIP zip backend. Attackers who control the destination string, combined with crafted source entries, can inject arbitrary command-line flags interpreted by zip. This leads to arbitrary command execution under the privileges of the Node.js process. Maintainer Nathan Friedly patched the flaw in versions 2.2.7 and 3.0.3.

Critical Impact
Attackers can execute arbitrary commands with Node.js process privileges by injecting flags into the Info-ZIP backend.

Affected Products

bestzip npm package version 2.2.6
bestzip npm package version 3.0.2
Node.js applications invoking nativeZip with attacker-influenced destination paths

Discovery Timeline

2026-09-09 - CVE-2026-87794 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87794

Vulnerability Analysis

The bestzip package wraps the native Info-ZIP zip binary to create archives from Node.js. The nativeZip function in lib/bestzip.js constructs the command-line arguments by placing the caller-supplied options.destination value directly into the argument array. Because the destination value is not resolved to an absolute path or otherwise disambiguated from a flag, a value beginning with - or -- is parsed by zip as an option rather than an output file name.

When combined with crafted source entries, an attacker can steer zip toward flags such as -T (test archive) or other options that trigger command execution behaviors in the backend. The process runs with the same privileges as the Node.js host application, making this a foothold in build pipelines, serverless jobs, and file-processing services that accept untrusted archive parameters.

Root Cause

The root cause is missing input validation on the destination parameter before argument assembly. The pre-patch code passes options.destination verbatim into the arguments list for the zip child process. There is no path resolution, no -- separator preceding the destination, and no rejection of values that begin with a dash.

Attack Vector

Exploitation requires local access to an application that exposes bestzip.nativeZip with attacker-controlled destination or source inputs. Any wrapper that forwards HTTP form fields, CLI arguments, or job parameters into these options creates the attack surface.

javascript

// Vulnerable pattern (pre-patch)
   const cwd = options.cwd || process.cwd();
   const command = "zip";
   const sources = await expandSources(cwd, options.source);

   const args = ["--quiet", "--recurse-paths", options.destination, "--"].concat(
     sources
   );

// Patched code (v2.2.7 / v3.0.3)
   const destination = path.resolve(cwd, options.destination);
   const args = ["--quiet", "--recurse-paths", destination, "--"].concat(
     sources
   );

Source: GitHub Bestzip Commit 2adb637

The fix wraps options.destination with path.resolve(cwd, ...), converting any attacker-supplied flag-like string into an absolute filesystem path that zip no longer interprets as an option.

Detection Methods for CVE-2026-87794

Indicators of Compromise

Child zip processes spawned by Node.js with argument values beginning with - or -- in positions other than known flags.
Unexpected creation of files in system-writable directories following archive operations.
Node.js processes writing to or reading from filesystem paths outside the application's normal working directory.

Detection Strategies

Inventory package-lock.json and yarn.lock files across repositories and container images for bestzip@2.2.6 or bestzip@3.0.2.
Instrument runtime process telemetry to flag zip invocations whose argv contains suspicious flag-like tokens where a destination path is expected.
Scan CI/CD build logs and serverless function code for direct or indirect calls into nativeZip that forward user-supplied parameters.

Monitoring Recommendations

Monitor EDR telemetry for node parent processes spawning zip with anomalous command lines.
Alert on any file creation outside the expected archive output directory during Node.js job execution.
Track outbound network connections initiated by processes descended from node shortly after archive operations.

How to Mitigate CVE-2026-87794

Immediate Actions Required

Upgrade bestzip to version 2.2.7 (for the 2.x branch) or 3.0.3 (for the 3.x branch).
Audit all application code paths that pass user-controlled data into bestzip options, particularly destination and source.
Rebuild and redeploy container images and serverless bundles that included the vulnerable package versions.

Patch Information

The fix is available in bestzip@2.2.7 and bestzip@3.0.3 on npm. The patch in commit 2adb637b0acb05b8475de7db5af4b86ffcf40aaf resolves the destination path with path.resolve(cwd, options.destination) before passing it to the zip backend. Details are published in GitHub Security Advisory GHSA-p87m-9567, GitHub Security Advisory GHSA-xhwx-rch4, and the VulnCheck Bestzip Argument Injection Advisory.

Workarounds

Validate and normalize the destination option in application code before invoking bestzip, rejecting values that begin with -.
Resolve destination paths with path.resolve() and confirm they remain inside an allowlisted output directory.
Run archive workloads under least-privilege service accounts to constrain post-exploitation impact.

bash

# Upgrade to the patched release
npm install bestzip@3.0.3 --save
# or for the 2.x branch
npm install bestzip@2.2.7 --save

# Verify the installed version
npm ls bestzip