CVE-2026-80427

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

CVE-2026-80427

bestzip (npm package node-bestzip) builds the argument list for the system zip utility without a -- delimiter between options and operands. Any caller-supplied source path beginning with a hyphen is interpreted by zip as an option rather than a file name. Because zip supports -T (test archive) an...