bestzip versions 2.2.6 and 3.0.2 contain an argument injection flaw in the nativeZip function that allows a malicious user to inject arbitrary arguments to the underlying Info‑ZIP backend. The vulnerability enables the execution of arbitrary commands with Node.js process privileges, which can compromise confidentiality, integrity, and availability of the system by running code that has the same permissions as the Node process. The weakness is classified as CWE‑88, a command injection type flaw.

The affected vendors/product is the bestzip library released by nfriedly. Affected releases are 2.2.6 and 3.0.2. Users of these Node.js packages that invoke the nativeZip function with user‑controlled paths or source entries are vulnerable.

The vulnerability has a high CVSS score of 8.6, indicating significant impact. EPSS is not available, but the lack of a KEV listing does not diminish the risk, especially for projects that deploy the vulnerable versions. Attackers must provide a malicious destination path and crafted source entries; the exploit is therefore possible when the library is used in an environment where untrusted input reaches nativeZip, such as web servers or CI pipelines that handle uploaded zip files. The exploit would let an attacker run arbitrary commands with the Node process level privileges, and could be used to lay persistence, exfiltrate data, or pivot to other systems.