{"id":"CVE-2026-71243","published":"2026-08-05T11:16:27.247","lastModified":"2026-08-10T12:17:26.857","description":"The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = \"mkdir -p \" + path.join(info.destination, info.name) + \"; \" - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/adaltas/node-backmeup","tags":[]}],"exploitRefs":[{"url":"https://github.com/adaltas/node-backmeup","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to inject malicious shell commands by directly concatenating user-controlled input, leading to remote code execution.","exploitability":"Exploitation is relatively easy given access to the npm package configuration and network permissions.","blast_radius":"If exploited, it could lead to full control over affected systems, including data theft or system compromise.","remediation":"Update to a fixed version of backmeup or use parameterized commands instead of direct string concatenation.","tags":["rce","npm","shell-injection","remote-code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:47:33.747Z"}}