CVE-2026-71243
Received Received - Intake

Command Injection in backmeup npm Package

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array. The only processing applied is path.normalize()/path.join(), which do not neutralize shell metacharacters (;, |, &, $(), backticks, newline). Any application that passes attacker-influenced values into these options (e.g. a user-chosen backup name) is vulnerable to arbitrary OS command execution on the backup host, or on the remote SSH target when one is configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71243
EUVD
EUVD-2026-53316

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adaltas backmeup *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the backmeup npm package improperly constructing shell commands by directly concatenating user-controlled input (name, source, destination, filter) into command strings. It then executes these strings via a shell using ssh2-exec or child_process, which allows attackers to inject arbitrary OS commands by including shell metacharacters like semicolons or pipes.

Detection Guidance

Check if the backmeup npm package is installed in your environment. Search for usage of the package in your codebase, particularly where shell commands are constructed with user-controlled inputs like name, source, destination, or filter options.

Impact Analysis

If you use the backmeup package and pass untrusted input into its options (e.g., user-chosen backup names), an attacker could execute arbitrary commands on your system or any remote SSH target configured for backups. This could lead to data theft, system compromise, or unauthorized access depending on the attacker's goals.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR (data protection) or HIPAA (health data security) by enabling unauthorized access to sensitive systems or data. Organizations using backmeup may face penalties for failing to protect personal or health information due to inadequate command injection safeguards.

Mitigation Strategies

Immediately stop using the backmeup package if it is installed. Replace it with a secure alternative that does not use shell command concatenation for executing commands. If you must use it, ensure all inputs passed to the package are sanitized and validated to remove shell metacharacters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart