Search for packages
| purl | pkg:npm/%40backstage/plugin-scaffolder-node@0.12.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-nwgc-2f7k-tkb2
Aliases: CVE-2026-24046 GHSA-rq6q-wr2q-7pgp |
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to: 1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets) 2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace 3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks This affects any Backstage deployment where users can create or execute Scaffolder templates. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:49:38.641472+00:00 | GitLab Importer | Affected by | VCID-nwgc-2f7k-tkb2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@backstage/plugin-scaffolder-node/CVE-2026-24046.yml | 38.6.0 |