Command Injection in bestzip
Summary
GHSA-4qqc-mp5f-ccv4: Command Injection in bestzip. Affects bestzip versions < 2.1.7. Fixed in 2.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bestzip package is an npm package that provides a command-line utility for creating zip archives. It is commonly used to compress files and directories. The package utilizes the native zip command available on the system to perform the compression. However, versions prior to 2.1.7 of bestzip are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability in bestzip arises from the package's failure to properly sanitize user input before passing it to the exec call on the zip function. This allows an attacker to execute arbitrary code on the system if they can control the value of the destination parameter. It is important to note that this vulnerability only affects users with a native zip command available. An attacker can exploit this vulnerability by providing malicious input to the bestzip command-line utility or programmatically through the zip function.
How To Fix
Latest published version: 4.0.3 as of 23 Oct 2026
npm install bestzip@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.7
This is the first release that contains the fix.
npm install bestzip@2.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of bestzip is not immediately possible, users can mitigate the risk by ensuring that the destination parameter is not under user control. This can be achieved by validating and sanitizing user input before passing it to the bestzip command or the zip function programmatically.
Conclusion
The bestzip package prior to version 2.1.7 is vulnerable to Command Injection, which can allow attackers to execute arbitrary code on the system. It is crucial to update to the latest version of the package or apply proper input sanitization to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bestzip →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the system with the privileges of the user running the bestzip command or the program utilizing the zip function. This can lead to unauthorized access, data loss, or further compromise of the system.
Users of bestzip versions prior to 2.1.7 are affected by this vulnerability. However, it is important to note that this vulnerability only affects users with a native zip command available.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
A workaround for this vulnerability is to ensure that the destination parameter is not under user control. This can be achieved by validating and sanitizing user input before passing it to the bestzip command or the zip function programmatically.
Yes, this vulnerability has been fixed in version 2.1.7 of the bestzip package. It is recommended to update to this version or later to ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for bestzip.
