CVE-2026-80427 is an argument injection vulnerability in the bestzip npm package, which wraps the system zip utility. The package fails to separate options from operands using a -- delimiter when building the argument list for zip. This allows attacker-controlled source path entries beginning with a hyphen to be interpreted as zip options rather than file names. By supplying -T and -TT flags along with a malicious command string, an attacker can cause zip to execute arbitrary shell commands after archive creation. Any application passing untrusted file paths to the bestzip API is vulnerable to arbitrary command execution. The vulnerability is fixed in versions 2.2.6 and 3.0.2, which add the required -- delimiter to separate options from operands.