Arbitrary OS Command Execution in backmeup npm Package by Adaltas

CVE-2026-71243

What is CVE-2026-71243?

The backmeup npm package is vulnerable to an arbitrary OS command execution flaw due to improper handling of user input. Specifically, the package constructs shell command strings by concatenating option values without sufficient sanitization. This vulnerability arises when attacker-controlled inputs can be injected into these shell commands, potentially leading to the execution of malicious commands on the host machine or on a remote SSH target. The lack of robust input validation and usage of contextual escaping means that any user who passes influenced values into these options could inadvertently facilitate this exploit.

References