{"id":"GHSA-4qqc-mp5f-ccv4","aliases":[],"status":"published","title":"Command Injection in bestzip","description":"Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:\n- `bestzip test.zip 'sourcefile; mkdir folder'`\n- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2020-09-02T15:05:51Z","modified":"2023-01-09T05:04:13Z","fixes":[{"ecosystem":"npm","package":"bestzip","fixed_in":["2.1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"bestzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.7"}]}]},{"source":"osv","ecosystem":"npm","package":"bestzip","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.7"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/1554","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4qqc-mp5f-ccv4"}],"sources":{"ghsa":[{"id":"GHSA-4qqc-mp5f-ccv4","title":"Command Injection in bestzip","description":"Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:\n- `bestzip test.zip 'sourcefile; mkdir folder'`\n- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`","status":"published","published":"2020-09-02T15:05:51Z","modified":"2023-01-09T05:04:13Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:08.863482Z"}],"osv":[{"id":"GHSA-4qqc-mp5f-ccv4","title":"Command Injection in bestzip","description":"Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:\n- `bestzip test.zip 'sourcefile; mkdir folder'`\n- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`","status":"published","published":"2020-09-02T15:05:51Z","modified":"2020-09-02T15:04:08Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}