Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dgvh-ebd7-d3gt
Vulnerability ID VCID-dgvh-ebd7-d3gt
Aliases CVE-2024-53983
GHSA-qmc2-jpr5-7rg9
Summary The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not change git config.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2024-53983
epss 0.00153 https://api.first.org/data/v1/epss?cve=CVE-2024-53983
cvssv3.1 5.4 https://github.com/backstage/backstage
cvssv4 4.3 https://github.com/backstage/backstage
generic_textual MODERATE https://github.com/backstage/backstage
cvssv3.1 5.4 https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
cvssv4 4.3 https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
generic_textual MODERATE https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
ssvc Track https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
cvssv3.1 5.4 https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
cvssv4 4.3 https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
generic_textual MODERATE https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
ssvc Track https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2024-53983
cvssv4 4.3 https://nvd.nist.gov/vuln/detail/CVE-2024-53983
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-53983
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-53983
https://github.com/backstage/backstage
https://nvd.nist.gov/vuln/detail/CVE-2024-53983
GHSA-qmc2-jpr5-7rg9 https://github.com/advisories/GHSA-qmc2-jpr5-7rg9
GHSA-qmc2-jpr5-7rg9 https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
scaffolder-node https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/backstage/backstage
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/backstage/backstage
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-02T22:15:55Z/ Found at https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-02T22:15:55Z/ Found at https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-53983
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-53983
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.35743
EPSS Score 0.00153
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:35:34.357427+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/53xxx/CVE-2024-53983.json 38.6.0