@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041, <=1.33.0)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-202110122318, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2021101022158, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2021101022158,...

CVE-2026-24046: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

Malicious Package

Overview backstage-plugin-glean is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

MAL-2025-192944 Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205460

Malicious code in backstage-plugin-glean npm...

EUVD-2025-11351

Malicious code in bioql PyPI...

@apollo/chakra-helpers (>=1.1.0, <=2.2.0), @backstage/plugin-apollo-explorer (>=0.0.0-nightly-20220719025614, <=0.1.17) potentially affected by CVE-2025-59845 via @apollo/explorer (>=0.2.1, <=2.0.2)

@apollo/explorer NPM version =0.2.1, =1.1.0, =0.0.0-nightly-20220719025614, =0.1.17 Source cves: CVE-2025-59845 Source advisory: MEND:CVE-2025-59845...

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285: Insertion of Sensitive Information into Log File

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

Malicious code in backstage-plugin-kubernetes-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d5e128ce958505a3df2acbdc6b87aaf80b05e6b5a1dec494681ab2ceced6a0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in backstage-plugin-kubernetes-backend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Server Side Request Forgery (SSRF)

@backstage/plugin-scaffolder-node is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of template functionality in the Backstage Scaffolder plugin, which allows Server-Side Template Injection SSTI to be exploited for Git config injection...