GHSA-2g8g-63j4-9w3r
GHSA-2g8g-63j4-9w3r · RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution. ### Impact A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data. ### Patches This is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`. ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node
Betroffene Produkte und Versionen
@backstage/plugin-scaffolder-backend npm
- Betroffene Versionsbereiche
- SEMVER: < 0.15.14
Auf 0.15.14 aktualisieren