CVE-2026-71243

8.8 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows attackers to inject malicious shell commands by directly concatenating user-controlled input, leading to remote code execution.
Exploitability: Exploitation is relatively easy given access to the npm package configuration and network permissions.
Blast radius: If exploited, it could lead to full control over affected systems, including data theft or system compromise.
Prioritized remediation: Update to a fixed version of backmeup or use parameterized commands instead of direct string concatenation.

rcenpmshell-injectionremote-code-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/adaltas/node-backmeup

All references

https://github.com/adaltas/node-backmeup

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.