CVE-2026-71243 [HIGH] – The backmeup npm package assembles shell command strings by directly concatenating its opt

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) – e.g. cmd = “mkdir -p ” + path.join(info.destination, info.name) + “; ” – and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array.