CVE-2023-35926
CVE-2023-35926 · Insecure sandbox in Backstage Scaffolder plugin
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.
CVSS 8.1 · High · EPSS 1.9% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
backstage
- Versions
- < 1.15.0: Affected
No fix published
@backstage/plugin-scaffolder-backend npm
- Affected ranges
- SEMVER: < 1.15.0
Update to 1.15.0