GHSA-4qqc-mp5f-ccv4
Command Injection in bestzip
Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled. This only affects users with a native zip command available. The following examples demonstrate the issue from the CLI and also programatically:
bestzip test.zip 'sourcefile; mkdir folder'zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })
What each source reports
GitHub AdvisoriesNo score
Command Injection in bestzip
Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled. This only affects users with a native zip command available. The following examples demonstrate the issue from the CLI and also programatically:
bestzip test.zip 'sourcefile; mkdir folder'zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })
- Record
GHSA-4qqc-mp5f-ccv4- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVNo score
Command Injection in bestzip
Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled. This only affects users with a native zip command available. The following examples demonstrate the issue from the CLI and also programatically:
bestzip test.zip 'sourcefile; mkdir folder'zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })
- Record
GHSA-4qqc-mp5f-ccv4- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bestzipnpm | before 2.1.7 | 2.1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4qqc-mp5f-ccv4 is a vulnerability with no CVSS score yet in bestzip, published September 2, 2020. No source lists public exploit code. Fixed in bestzip 2.1.7.