The backmeup npm package assembles shell command strings by concatenating option values such as name, source, destination, and filter directly into a command string (e.g., cmd = "mkdir -p " + path.join(info.destination, info.name) + "; ") and executes this string through a shell using ssh2-exec, either locally via child_process or remotely via SSH. This approach does not use safer methods like execFile or spawn with argument arrays, leading to a CWE-78 OS command injection vulnerability. An attacker with low privileges can exploit this to execute arbitrary commands, potentially compromising confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution with the privileges of the backmeup process, resulting in full system compromise including data theft, modification, or destruction. The CVSS v3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. As a temporary measure, avoid using untrusted input in backmeup options that influence shell commands. Consider restricting usage to trusted environments until a fix is released.