CVE-2026-87794

bestzip, an npm package that shells out to the Info-ZIP command-line tool, contains an argument injection flaw (CWE-88) in its nativeZip function in versions 2.2.6 and 3.0.2. An attacker who can control the destination path or the source entry names passed to a zip operation can inject additional command-line arguments to the Info-ZIP backend, causing it to execute arbitrary commands. Successful exploitation runs those commands with the privileges of the Node.js process, which in practice means developer workstations and CI/CD build runners rather than internet-facing production services. Any project or build pipeline using the affected versions of bestzip is exposed, and fixed releases are available in the 2.2.7 and 3.0.3 versions. No public proof-of-concept, CISA KEV listing, or reports of in-the-wild exploitation are known at this time.

What to do: Upgrade to bestzip 2.2.7 if you are on the 2.x line or 3.0.3 if you are on the 3.x line. Until upgraded, treat any destination paths and source entry names passed to nativeZip as untrusted input and validate or sanitize them, since attacker-controlled paths are the injection vector. Review build and CI logs (including Electron packaging pipelines) for unexpected child processes spawned by the zip command.