AIKIDO-2026-10073
borgmatic is vulnerable to Command Injection
77
High Risk
This Affects:
borgmaticTL;DR
Affected versions of this package are vulnerable to shell injection via constant interpolation in command hooks because unescaped constant values could be executed in the shell when used in hook commands. This could allow an attacker controlling configuration constants to inject and run arbitrary shell commands. The issue is fixed by requiring proper interpolation escaping in these contexts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
borgmatic is vulnerable to Command Injection in versions 1.0.0 - 2.0.13.
How to fix this
Upgrade the borgmatic library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant