The backmeup npm package builds shell command strings by directly concatenating user‑supplied option values, such as backup name, source, destination and filter. These values are passed to a shell via ssh2‑exec or child_process without any escaping or argument array usage. The only transformations applied are path.normalize() and path.join(), which do not neutralize shell metacharacters like ;, |, &, $(), backticks, or newlines. The result is a classic OS command injection vulnerability (CWE‑78) that allows an attacker to execute arbitrary commands on the host performing the backup or on a remote SSH target when a connection is supplied.

The affected product is the backmeup module released by adaltas. No specific version ranges are documented by the CNA, so any installed instance that accepts untrusted option values could be vulnerable.

The CVSS score of 8.8 indicates a high‑severity vulnerability. With the EPSS score not disclosed, the exploit probability is currently unknown, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented widespread exploitation yet. An attacker can trigger the flaw by supplying malicious values for the backup name, source, destination or filter options, causing the concatenated shell command to be executed either locally or on a remote SSH target. Local execution requires the attacker's ability to influence the options, while remote execution needs a valid SSH session to the target, usually granted by the application. The lack of a vendor‑provided patch means remediation relies on application‑level mitigations.