An argument injection vulnerability in the bestzip Node.js library allows unauthenticated attackers to achieve remote code execution by injecting malicious arguments into the Info-ZIP backend.

This flaw exists in the nativeZip function, which improperly handles input when passing arguments to the system-level Info-ZIP utility. An attacker can supply a crafted destination path or source entry to inject arbitrary command-line arguments, leading to command execution with the privileges of the Node.js process.

The ability to execute arbitrary commands on a server hosting this library poses a critical risk to business operations. An attacker could gain full control over the host environment, leading to unauthorized data exfiltration, system compromise, or complete service disruption. With a CVSS score of 8.4, this vulnerability represents a high-severity threat that requires immediate attention to prevent potential system-wide exploitation.

Immediate Action: Update the bestzip package to version 2.2.7 or 3.0.3 immediately to incorporate the necessary argument sanitization logic.

Proactive Monitoring: Review application logs for unexpected or malformed input parameters being passed to zip-related functions, and monitor system process trees for suspicious child processes spawned by the Node.js runtime.

Compensating Controls: If immediate patching is not feasible, restrict the application environment to a highly sandboxed container with minimal filesystem permissions to limit the impact of potential command execution.

Public Exploit Available: Unknown

The vulnerability in bestzip is severe due to the potential for unauthenticated remote code execution. Administrators should prioritize updating to the patched versions, 2.2.7 or 3.0.3, across all production environments. Given the potential for full system compromise, verify the integrity of the updated dependencies and ensure that the application process runs with the least privilege necessary to further reduce the attack surface.