Advisories for Golang/Github.com/Kopia/Kopia package

Kopia's HTTP server, when started with –without-password , accepts unauthenticated requests to /api/v1/repo/exists. The handler forwards an attacker-supplied storage configuration to blob.NewStorage. For SFTP backends with externalSSH: true, that path constructs a process command line by splitting sshArguments on spaces and passes the result directly to exec.CommandContext("ssh"). An -oProxyCommand=<cmd> token in sshArguments causes OpenSSH to invoke <cmd> via $SHELL -c before any TCP connection is attempted, giving the requester arbitrary …

What kind of vulnerability is it? Who is impacted? Storage credentials are written to the console.