The backmeup npm package builds shell command strings by directly concatenating option values such as name, source, destination, and filter. These concatenated strings are executed through a shell via ssh2‑exec (for remote execution) or child_process (for local execution), instead of using execFile or spawn with an argument array. Because no escaping or input validation is performed, shell metacharacters within any of the option values can manipulate the command string, resulting in an OS command injection vulnerability (CWE‑78). An attacker who can influence any of these option values can trigger arbitrary command execution on the machine performing the backup or on a remote SSH target.

The affected product is the backmeup module released by adaltas. No specific version ranges are documented by the CNA, so any installed instance that accepts untrusted option values could be vulnerable.

The CVSS score of 8.8 indicates a high‑severity vulnerability. With the EPSS score of 0.00416, the exploit probability is very low but nonzero, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented widespread exploitation yet. An attacker can trigger the flaw by supplying malicious values for the backup name, source, destination or filter options, causing the concatenated shell command to be executed either locally or on a remote SSH target. Local execution requires the attacker's ability to influence the options, while remote execution needs a valid SSH session to the target, usually granted by the application. The lack of a vendor‑provided patch means remediation relies on application‑level mitigations.