The vulnerability in bestzip arises from an argument injection flaw produced by the library’s failure to insert a delimiter between the destination archive and the list of source files. When a supplied source path begins with a hyphen, the zip utility interprets that entry as an option rather than a file name. Attackers can provide entries such as -T or -TT and include a command string, causing zip to execute that command through a shell after the archive is finished. This flaw allows arbitrary command execution with the privileges of the process that invoked bestzip and represents a functionally critical weakness (CWE-88).

Affected installations use bestzip versions prior to 2.2.6 and prior to 3.0.2. The library is distributed via npm and widely employed in Node.js projects. Any application that passes user-supplied file names to the bestzip API is vulnerable. The problem was mitigated in bestzip 2.2.6 and 3.0.2 by inserting the missing argument delimiter.

The CVSS score of 8.6 signals a high severity vulnerability. Although an EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, the capability to execute arbitrary code remains dramatically dangerous. The flaw can be exploited locally or remotely whenever an attacker can influence the file paths passed to bestzip, meaning that any application receiving untrusted filenames is at risk until patched.