Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/%40backstage/plugin-scaffolder-backend@1.8.0-next.2 |
|---|
| Type | npm |
|---|
| Namespace | @backstage |
|---|
| Name | plugin-scaffolder-backend |
|---|
| Version | 1.8.0-next.2 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 3.1.5 |
|---|
| Latest_non_vulnerable_version | 3.1.5 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-1v1x-ccrc-bqea |
| vulnerability_id |
VCID-1v1x-ccrc-bqea |
| summary |
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-55285, GHSA-3x3q-ghcp-whf7
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1v1x-ccrc-bqea |
|
| 1 |
| url |
VCID-4qeh-pyrt-zfat |
| vulnerability_id |
VCID-4qeh-pyrt-zfat |
| summary |
Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-29184, GHSA-8qp7-fhr9-fw53
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4qeh-pyrt-zfat |
|
| 2 |
| url |
VCID-kn33-aucx-bucn |
| vulnerability_id |
VCID-kn33-aucx-bucn |
| summary |
Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-35926, GHSA-wg6p-jmpc-xjmr
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kn33-aucx-bucn |
|
| 3 |
| url |
VCID-t9gj-dq52-a3a3 |
| vulnerability_id |
VCID-t9gj-dq52-a3a3 |
| summary |
Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Backstage deployment where users can create or execute Scaffolder templates. This vulnerability is fixed in `@backstage/backend-defaults` versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0; `@backstage/plugin-scaffolder-backend` versions 2.2.2, 3.0.2, and 3.1.1; and `@backstage/plugin-scaffolder-node` versions 0.11.2 and 0.12.3. Users should upgrade to these versions or later. Some workarounds are available. Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates, restrict who can create and execute Scaffolder templates using the permissions framework, audit existing templates for symlink usage, and/or run Backstage in a containerized environment with limited filesystem access. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-24046, GHSA-rq6q-wr2q-7pgp
|
| risk_score |
4.1 |
| exploitability |
0.5 |
| weighted_severity |
8.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t9gj-dq52-a3a3 |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 4.1 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-scaffolder-backend@1.8.0-next.2 |
|---|