A high-severity argument injection vulnerability in the nfriedly bestzip library allows unauthenticated local attackers to achieve arbitrary command execution.

The library improperly neutralizes argument delimiters when constructing commands for the system zip utility. By providing a specially crafted file name or path, an unauthenticated user can force the underlying zip process to execute arbitrary shell commands.

Successful exploitation of this vulnerability leads to full system compromise, as the attacker can execute commands with the privileges of the application process. Given the CVSS score of 8.4, the risk of unauthorized data access and system manipulation is severe, necessitating immediate remediation to maintain the integrity and confidentiality of the host environment.

Immediate Action: Update the bestzip dependency to version 2.2.6 or 3.0.2, which introduce the necessary argument delimiters to prevent injection.

Proactive Monitoring: Review application logs for unusual file paths or suspicious characters, such as hyphens at the start of filenames, being processed by the bestzip API.

Compensating Controls: Implement strict input validation on all user-supplied file names or paths before passing them to the bestzip library to ensure they conform to expected formats and do not contain shell command sequences.

Public Exploit Available: Unknown

The vulnerability presents a significant risk of remote code execution if the library is used to handle untrusted user input. Security teams must prioritize updating to the patched versions immediately to eliminate the underlying command injection vector and secure the application environment.