CVE-2026-80427

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

CVE-2026-80427 bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

CVE-2026-80427

bestzip (npm package node-bestzip) builds the argument list for the system zip utility without a -- delimiter between options and operands. Any caller-supplied source path beginning with a hyphen is interpreted by zip as an option rather than a file name. Because zip supports -T (test archive) an...

EUVD-2026-66601

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

CVE-2026-80427 bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by...

PT-2026-82213

Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2 Description The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied...

EUVD-2021-0979

Malware in sbrugna...

Command injection in bestzip

Overview Affected versions of the package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. Recommendation Upgrade to version 2.1.7 or later References - CVE - GitHub Advisory...

GHSA-6XV6-JPVW-CX6Q Command injection in bestzip

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

Command injection in bestzip

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

@adobe/aem-site-template-builder (>=0.1.7, <=0.1.8), vulnerable-js (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-7730 via bestzip (2.1.6)

bestzip NPM version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on bestzip and may be impacted: - @adobe/aem-site-template-builder =0.1.7, =1.0.0, =1.0.2 Source cves: CVE-2020-7730 Source advisory: OSV:GHSA-6XV6-JPVW-CX6Q...

CVE-2020-7730

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

CVE-2020-7730

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

Command injection

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

CVE-2020-7730

CVE-2020-7730 affects the npm package bestzip prior to version 2.1.7, which is vulnerable to Command Injection via the options parameter. The vulnerability is described across multiple sources (NVD/NVDC, OSV, GitHub advisories, and npm advisories) with a high-severity impact (CVSS v3.1: CRITICAL,...

CVE-2020-7730

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

OS Command Injection

bestzip is vulnerable to OS command injection. A remote attacker is able to inject and execute arbitrary OS commands on the host OS via the destination parameter...

@adobe/aem-site-template-builder (>=0.1.7, <=0.1.8), vulnerable-js (>=1.0.0, <=1.0.2) potentially affected by unknown CVE via bestzip (2.1.6)

bestzip NPM version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on bestzip and may be impacted: - @adobe/aem-site-template-builder =0.1.7, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: OSV:GHSA-4QQC-MP5F-CCV4...

GHSA-4QQC-MP5F-CCV4 Command Injection in bestzip

Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled...

Command Injection in bestzip

Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled...