Search
Search Results (3 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87794 | 1 Bestzip Project | 1 Bestzip | 2026-09-09 | 8.4 High |
| bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3. | ||||
| CVE-2026-80427 | 1 Bestzip Project | 1 Bestzip | 2026-08-26 | 8.4 High |
| bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier's choosing. Versions 2.2.6 and 3.0.2 add the delimiter. | ||||
| CVE-2020-7730 | 1 Bestzip Project | 1 Bestzip | 2024-11-21 | 9.8 Critical |
| The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. | ||||
Page 1 of 1.