Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:npm/%40backstage/plugin-scaffolder-node@0.12.3

Type npm

Namespace @backstage

Name plugin-scaffolder-node

Version 0.12.3

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version null

Latest_non_vulnerable_version null

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-nwgc-2f7k-tkb2

vulnerability_id VCID-nwgc-2f7k-tkb2

summary

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets)
2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace
3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

references

reference_url	https://github.com/backstage/backstage
reference_id
reference_type
scores
url	https://github.com/backstage/backstage

reference_url	https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
reference_id
reference_type
scores
url	https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2026-24046
reference_id	CVE-2026-24046
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2026-24046

reference_url	https://github.com/advisories/GHSA-rq6q-wr2q-7pgp
reference_id	GHSA-rq6q-wr2q-7pgp
reference_type
scores
url	https://github.com/advisories/GHSA-rq6q-wr2q-7pgp

reference_url	https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
reference_id	GHSA-rq6q-wr2q-7pgp
reference_type
scores
url	https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp

fixed_packages

url	pkg:npm/%40backstage/plugin-scaffolder-node@0.11.2
purl	pkg:npm/%40backstage/plugin-scaffolder-node@0.11.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-scaffolder-node@0.11.2

url	pkg:npm/%40backstage/plugin-scaffolder-node@0.12.3
purl	pkg:npm/%40backstage/plugin-scaffolder-node@0.12.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-scaffolder-node@0.12.3

aliases CVE-2026-24046, GHSA-rq6q-wr2q-7pgp

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nwgc-2f7k-tkb2

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540backstage/plugin-scaffolder-node@0.12.3

Package Instance