Severity: critical

Command Injection



Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled. This only affects users with a native zip command available. The following examples demonstrate the issue from the CLI and also programatically:

  • bestzip 'sourcefile; mkdir folder'
  • zip({ source: 'sourcefile', destination: './; mkdir folder' })


Upgrade to version 2.1.7 or later.

Have content suggestions? Send them to [email protected]

Advisory timeline

  1. published

    Advisory Published
    Sep 2nd, 2020
  2. reported

    Reported by Konrad Linkowski
    Sep 2nd, 2020