{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/bestzip/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.4,"id":"CVE-2026-80427"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["bestzip"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe bestzip library, a Node.js utility for creating zip archives, contains a critical vulnerability (CVE-2026-80427) involving improper argument sanitization when invoking the underlying system 'zip' binary. The library constructs the command line arguments for the zip process without using the '--' delimiter to separate command options from source file operands.\u003c/p\u003e\n\u003cp\u003eAn attacker who can influence the list of files or paths passed to the bestzip API can provide a file path starting with a hyphen. Because the zip utility processes arguments in order, these attacker-supplied strings are interpreted as command options. By supplying the '-T' and '-TT' flags followed by a malicious command string, an attacker can coerce the zip utility to execute that command via a shell upon completion of the archive operation. This impacts applications that allow users to influence file names or directory paths that are subsequently processed by the bestzip library. Versions 2.2.6 and 3.0.2 introduced a fix by implementing the mandatory '--' delimiter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution on the host system with the privileges of the application process running the bestzip library. This vulnerability affects any Node.js application relying on bestzip to process untrusted file inputs, potentially leading to full system compromise, exfiltration of sensitive data, or lateral movement within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the bestzip dependency to version 2.2.6 or 3.0.3 (or later) to ensure the '--' delimiter is correctly applied to system calls.\u003c/li\u003e\n\u003cli\u003eAudit applications using bestzip to identify if user-provided file names or directory paths are passed to the library functions without server-side validation.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or sanitization for all file paths before they are passed to archive-related APIs.\u003c/li\u003e\n\u003cli\u003eMonitor for suspicious child process spawning originating from Node.js applications, specifically targeting the execution of 'zip' or 'unzip' with unusual command line arguments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-26T16:22:02Z","date_published":"2026-08-26T16:22:02Z","id":"https://feed.craftedsignal.io/briefs/2026-08-bestzip-command-injection/","summary":"The bestzip library improperly handles file paths passed to the system zip utility, allowing attackers to inject command line flags and execute arbitrary code by passing paths beginning with hyphens.","title":"Arbitrary Command Execution in bestzip Library via Argument Injection","url":"https://feed.craftedsignal.io/briefs/2026-08-bestzip-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Bestzip","version":"https://jsonfeed.org/version/1.1"}