The backmeup npm package constructs shell command strings by directly concatenating option values such as name, source, destination, and filter without properly sanitizing shell metacharacters. These commands are executed via a shell either locally or remotely over SSH. The only processing applied is path normalization and joining, which do not neutralize dangerous shell characters like ;, |, &, $(), backticks, or newlines. This results in an OS command injection vulnerability (CWE-78) that allows arbitrary command execution on the backup host or remote SSH target when attacker-controlled input is supplied to these options.

Successful exploitation allows an attacker with the ability to influence option values to execute arbitrary OS commands with the privileges of the backmeup process on the local or remote system. This can lead to full system compromise, data loss, or further lateral movement. The CVSS 3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available. Users should avoid passing untrusted input to the vulnerable options (name, source, destination, filter) in backmeup. Consider isolating the execution environment or using alternative backup solutions until a fix is released. Monitor the vendor advisory for updates regarding patches or official mitigations.