p PatchFirst

PatchFirst · Latest vulnerabilities

@backstage/plugin-scaffolder-node vulnerabilities

Vulnerabilities published for @backstage/plugin-scaffolder-node in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-24046

    High · CVSS 7.1EPSS 0.53%Public exploitFix available

    Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

    Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Bac

    @backstage/plugin-scaffolder-node @backstage/plugin-scaffolder-nodeNode.js
    • Update to 0.11.2
    • Update to 0.12.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2024-53983

    Medium · CVSS 5.4EPSS 0.37%Fix available

    Server-side request forgery in Backstage Scaffolder plugin

    The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. The issue has be

    @backstage/plugin-scaffolder-node @backstage/plugin-scaffolder-node @backstage/plugin-scaffolder-nodeNode.js
    • Update to 0.4.12
    • Update to 0.5.1
    • Update to 0.6.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →