CVE-2026-71243 Details

A vulnerability in the backmeup npm package allows for arbitrary operating system command execution. This issue arises because the package constructs shell command strings by directly concatenating option values, such as name, source, destination, and filter. The resulting command string is executed through a shell via ssh2-exec, using either child_process for local execution or SSH for remote execution, when an SSH handle is provided. The only modification applied to the option values is basic path normalization, which does not remove shell metacharacters. As a result, any application that incorporates user-influenced values into these options, like a backup filename, could be exploited to execute arbitrary commands on the local or remote SSH target.