CVE-2026-71243

Name of the Vulnerable Software and Affected Versions backmeup (affected versions not specified)

Description The backmeup npm package is susceptible to OS command injection because it constructs shell command strings by directly concatenating option values instead of using an argument array with execFile or spawn. The package uses path.normalize() and path.join(), which fail to neutralize shell metacharacters such as ;, |, &, $(), backticks, and newlines. When an application passes attacker-controlled values into the name, source, destination, or filter variables, it allows for arbitrary OS command execution on the backup host or a remote SSH target if configured.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.