EUVD-2026-53316
GHSA-c6xg-rfqh-85cp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects the need for application-level access to supply option values; AV:N is valid when the application exposes backup configuration over a network interface with no additional complexity.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
2DescriptionCVE.org
The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array. The only processing applied is path.normalize()/path.join(), which do not neutralize shell metacharacters (;, |, &, $(), backticks, newline). Any application that passes attacker-influenced values into these options (e.g. a user-chosen backup name) is vulnerable to arbitrary OS command execution on the backup host, or on the remote SSH target when one is configured.
Articles & Coverage 1
AnalysisAI
OS command injection in the backmeup npm package allows any attacker who can supply input to the package's name, source, destination, or filter options to execute arbitrary shell commands on the backup host or, when SSH mode is configured, on the remote SSH target. The flaw stems from direct string concatenation of option values into shell command strings executed via child_process or ssh2-exec, with no neutralization of metacharacters beyond path.normalize() and path.join(). No public exploit has been identified at time of analysis, but the CVSS vector (PR:L, AV:N, AC:L) indicates this is straightforwardly exploitable by any low-privilege application user whose input reaches the vulnerable call sites.
Technical ContextAI
backmeup is a Node.js npm package providing backup orchestration. It constructs shell command strings by raw string concatenation - e.g., cmd = 'mkdir -p ' + path.join(info.destination, info.name) + '; ' - and dispatches the resulting string to ssh2-exec, which invokes child_process.exec() locally or executes via SSH when a remote ssh handle is supplied. The root cause is CWE-78 (Improper Neutralization of Special Elements Used in an OS Command): path.normalize() and path.join() handle filesystem path normalization but do not escape or strip shell metacharacters (;, |, &, $(), backticks, newline characters). The correct architecture is to use child_process.execFile() or spawn() with a discrete argument array, which bypasses shell interpretation entirely and makes metacharacter injection structurally impossible. No CPE string was provided in the input data; the affected artifact is the backmeup package on the npm registry, sourced from https://github.com/adaltas/node-backmeup.
RemediationAI
No vendor-released patch has been identified at time of analysis. The sole reference in the advisory points to the upstream GitHub repository at https://github.com/adaltas/node-backmeup; no fixed npm release version has been confirmed from the available data. Application owners should immediately audit all call sites where backmeup option values derive from external input and apply strict allowlist validation - permitting only alphanumeric characters, hyphens, underscores, and filesystem path separators in name, source, destination, and filter values, and rejecting any input containing shell metacharacters (;, |, &, backtick, $, (, ), newline). The trade-off of this control is that it may reject legitimate backup paths containing special characters, so validate against actual operational requirements. Where feasible, replace backmeup with a backup library that uses execFile or spawn with an argument array rather than shell string construction, eliminating the metacharacter attack surface structurally. Monitor the npm registry and the upstream GitHub repository for a patched release and upgrade immediately upon availability.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today