CyberRota Analysis
AI-GeneratedThe backmeup npm package is vulnerable to arbitrary OS command execution due to its insecure handling of user-supplied input when constructing shell command strings. This vulnerability allows an attacker to execute arbitrary commands on the backup host or a remote SSH target by manipulating option values such as the backup name. Developers and organizations using this package should prioritize immediate remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array.