Timur Juraev

**Name of the Vulnerable Software and Affected Versions** backmeup (affected versions not specified) **Description** The backmeup npm package is susceptible to OS command injection because it constructs shell command strings by directly concatenating option values instead of using an argument array with `execFile` or `spawn`. The package uses `path.normalize()` and `path.join()`, which fail to neutralize shell metacharacters such as `;`, `|`, `&`, `$()`, backticks, and newlines. When an application passes attacker-controlled values into the `name`, `source`, `destination`, or `filter` variables, it allows for arbitrary OS command execution on the backup host or a remote SSH target if configured. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.