{"kind": "product", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "name": "@backstage/plugin-scaffolder-backend", "product": "@backstage/plugin-scaffolder-backend", "ecosystem": "npm", "items": [{"id": "CVE-2026-106506", "noindex": false, "published": "2026-10-06T21:44:31.904Z", "modified": "2026-10-07T17:06:30.804Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00218, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106506", "title": "Backstage: Improper input validation in scaffolder task list ordering", "description": "Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-vwp5-f99x-x3rq", "https://github.com/backstage/backstage/commit/e673a869449874a9169e8f89852e75e862011b93", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106504", "noindex": false, "published": "2026-10-06T21:40:15.510Z", "modified": "2026-10-07T16:20:53.466Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00257, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106504", "title": "Backstage: Sensitive information exposure in scaffolder task logs", "description": "Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444", "https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106503", "noindex": false, "published": "2026-10-06T21:37:33.675Z", "modified": "2026-10-09T01:55:54.101Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00391, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106503", "title": "Backstage: Scaffolder action input authorization bypass", "description": "Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv", "https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188", "https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1"], "fixes": ["3.3.1", "3.4.1", "4.0.3", "4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106502", "noindex": false, "published": "2026-10-06T21:34:43.208Z", "modified": "2026-10-07T15:09:21.445Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00291, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106502", "title": "Backstage: Sensitive information may be exposed in Scaffolder task failure events", "description": "Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm", "https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106501", "noindex": false, "published": "2026-10-06T21:32:25.997Z", "modified": "2026-10-07T17:06:36.850Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "severity": "critical", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106501", "title": "Backstage: Sensitive information exposure in Scaffolder", "description": "Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p", "https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5", "https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5"], "fixes": ["3.3.1", "3.4.1", "4.0.3", "4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106500", "noindex": false, "published": "2026-10-06T21:29:10.626Z", "modified": "2026-10-07T15:48:01.118Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00336, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106500", "title": "Backstage: Improper task state validation in Scaffolder backend", "description": "Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf", "https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae", "https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106499", "noindex": false, "published": "2026-10-06T21:25:56.166Z", "modified": "2026-10-07T17:46:09.812Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0027, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106499", "title": "Backstage: Secret-derived values may be exposed in scaffolder task logs", "description": "Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg", "https://github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106462", "noindex": false, "published": "2026-10-06T20:30:28.855Z", "modified": "2026-10-07T15:13:57.430Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106462", "title": "Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback", "description": "Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44", "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-106461", "noindex": false, "published": "2026-10-06T20:25:32.100Z", "modified": "2026-10-07T16:23:06.058Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106461", "title": "Backstage: Incorrect authorization in scaffolder task listing", "description": "Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6", "https://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["4.1.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-32237", "noindex": false, "published": "2026-03-12T18:38:57.156Z", "modified": "2026-03-12T20:46:35.503Z", "cvss": 4.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00252, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-32237", "title": "@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint", "description": "Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all parts of the response payload. Deployments that have configured scaffolder.defaultEnvironment.secrets are affected. This is patched in @backstage/plugin-scaffolder-backend version 3.1.5.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77", "https://github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce", "https://nvd.nist.gov/vuln/detail/CVE-2026-32237"], "fixes": ["3.1.5"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-29184", "noindex": false, "published": "2026-03-07T15:03:18.226Z", "modified": "2026-03-09T20:24:16.597Z", "cvss": 2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-29184", "title": "@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass", "description": "Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53", "https://nvd.nist.gov/vuln/detail/CVE-2026-29184"], "fixes": ["3.1.4"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2026-24046", "noindex": false, "published": "2026-01-21T22:36:30.794Z", "modified": "2026-07-15T01:17:34.920Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L", "severity": "high", "epss": 0.00525, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-24046", "title": "Backstage has a Possible Symlink Path Traversal in Scaffolder Actions", "description": "Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files via the `debug:log` action by creating a symlink pointing to sensitive files (e.g., `/etc/passwd`, configuration files, secrets); delete arbitrary files via the `fs:delete` action by creating symlinks pointing outside the workspace, and write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks. This affects any Bac", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp", "https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d", "https://access.redhat.com/security/cve/CVE-2026-24046"], "fixes": ["2.2.2", "3.0.2", "3.1.1"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}, {"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2025-55285", "noindex": false, "published": "2025-08-15T17:10:26.735Z", "modified": "2025-08-15T17:49:24.677Z", "cvss": 2.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N", "severity": "low", "epss": 0.00243, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-55285", "title": "@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`", "description": "@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7", "https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e", "https://nvd.nist.gov/vuln/detail/CVE-2025-55285"], "fixes": ["2.1.1"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2023-35926", "noindex": false, "published": "2023-06-22T13:29:03.361Z", "modified": "2024-12-05T17:48:07.987Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.01888, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-35926", "title": "Insecure sandbox in Backstage Scaffolder plugin", "description": "Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities  that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML defin", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr", "https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a", "https://github.com/backstage/backstage/releases/tag/v1.15.0"], "fixes": ["1.15.0"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "GHSA-2g8g-63j4-9w3r", "noindex": false, "published": "2021-12-01T18:29:12Z", "modified": "2021-11-29T19:39:57Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-2g8g-63j4-9w3r", "title": "RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend", "description": "The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.\n\n### Impact\nA malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.\n\n### Patches\nThis is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`.\n\n\n### For more information\nIf yo", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-2g8g-63j4-9w3r", "https://github.com/backstage/backstage", "https://osv.dev/vulnerability/GHSA-2g8g-63j4-9w3r"], "fixes": ["0.15.14"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2021-43783", "noindex": false, "published": "2021-11-29T19:20:09.000Z", "modified": "2024-08-04T04:03:08.643Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "severity": "high", "epss": 0.01246, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2021-43783", "title": "Path Traversal in @backstage/plugin-scaffolder-backend", "description": "@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance. This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the fil", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-mg3m-f475-28hv", "https://github.com/backstage/backstage/commit/f9352ab606367cd9efc6ff048915c70ed3013b7f", "https://nvd.nist.gov/vuln/detail/CVE-2021-43783"], "fixes": ["0.15.14"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}, {"id": "CVE-2021-41151", "noindex": false, "published": "2021-10-18T20:30:10.000Z", "modified": "2024-08-04T02:59:31.637Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.01315, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2021-41151", "title": "Path Traversal in @backstage/plugin-scaffolder-backend", "description": "Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. Th", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-pvv8-8fx9-h673", "https://github.com/backstage/backstage/commit/6968962c920508eae19a4c1c200fa2c8980a4006", "https://nvd.nist.gov/vuln/detail/CVE-2021-41151"], "fixes": ["0.15.9"], "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}]}], "total": 17, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@backstage/plugin-scaffolder-backend", "path": "vulns/npm/@backstage%2Fplugin-scaffolder-backend", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 9, "kev": 0}, "lastmod": "2026-10-09T01:55:54.101Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}