Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/%40backstage/plugin-scaffolder-node@0.12.0
purl pkg:npm/%40backstage/plugin-scaffolder-node@0.12.0
Next non-vulnerable version 0.12.3
Latest non-vulnerable version 0.12.3
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-nwgc-2f7k-tkb2
Aliases:
CVE-2026-24046
GHSA-rq6q-wr2q-7pgp
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to: 1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets) 2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace 3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks This affects any Backstage deployment where users can create or execute Scaffolder templates.
0.12.3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:49:38.641472+00:00 GitLab Importer Affected by VCID-nwgc-2f7k-tkb2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@backstage/plugin-scaffolder-node/CVE-2026-24046.yml 38.6.0