MAL-2025-17817 Malicious code in cubx-wct-tst-scaffolder (npm)

The package cubx-wct-tst-scaffolder was found to contain malicious code...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2023-35926

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...

CVE-2021-43783

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend...

CVE-2025-32791

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission...

CVE-2025-32791

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission...

CVE-2025-32791

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission...

CVE-2025-32791: Exposure of Sensitive Information Due to Incompatible Policies

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.1.1-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021101022158, <=0.0.0-nightly-20260928023907) +25 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.4.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20230325022054,...

@backstage/backend-dynamic-feature-service (>=0.4.2-next.1, <=0.4.2-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338, <=1.26.0-next.2) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.5.0-next.2)

@backstage/plugin-scaffolder-node NPM version 0.5.0-next.2 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/backend-dynamic-feature-service =0.4.2-next.1, =0.0.0-nightly-20241017023338,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535) +1 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.6.0)

@backstage/plugin-scaffolder-node NPM version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20241120023536,...

GHSA-QMC2-JPR5-7RG9 Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983

The CVE concerns Backstage Scaffolder template handling where Server-Side Template Injection (SSTI) can be abused to inject Git config and capture privileged Git tokens used by the Backstage Scaffolder plugin. This enables unauthorized access to Git resources, with a medium impact per the Backsta...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

PT-2024-35995

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-scaffolder-node versions prior to 0.4.12, 0.5.1, and 0.6.1 Description: A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git...