Package Instance

@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
A malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs.

The attack requires:
- The ability to register a template in the catalog
- A victim who executes the malicious template

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

1. **Read arbitrary files** via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets)
2. **Delete arbitrary files** via the `fs:delete` action by creating symlinks pointing outside the workspace
3. **Write files outside the workspace** via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

Template Secret leakage in logs in Scaffolder when using `fetch:template`
A logging flaw in Backstage Scaffolder’s `fetch:template` action up to `@backstage/plugin-scaffolder-backend` **2.1.0** may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the `{{ secrets }}` bag could appear in local/server logs when the action ran. Exploitation requires use of the `secrets` argument and access to Scaffolder/build logs; integrity and availability are unaffected.

*   **Fix:** upgrade to `2.1.1`, which removes the duplicate log path and ensures secrets are redacted.
*   **Mitigation:** avoid passing `{{ secrets }}` to `fetch:template` if upgrade is not possible.

> Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
>
> Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)