@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.0) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.2-next.1)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.0) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.2-next.1)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

CVE-2026-24046

The Backstage framework is vulnerable to symlink-based path traversal attacks in multiple Scaffolder actions and archive extraction utilities. An attacker capable of creating and executing Scaffolder templates can exploit these symlinks to read arbitrary files (e.g., /etc/passwd, secrets) via the...

CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2026-24046

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

Backstage Backlink Vulnerability

Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Backstage has a postback link vulnerability, which stems from multiple Scaffolder operations and archive extraction tools being susceptible to path traversal attacks based...

PT-2026-3875

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 @backstage/plugin-scaffolder-backend versions prior to 2.2.2, 3.0.2, and 3.1.1 @backstage/plugin-scaffolder-node versions prior to 0.11.2 and 0.12.3 Description The software is...

CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

EUVD-2021-2243

Malware in sbrugna...

EUVD-2021-2554

Malware in sbrugna...

EUVD-2025-25046

Malicious code in bioql PyPI...

EUVD-2024-3501

Malicious code in bioql PyPI...

EUVD-2023-1899

Malicious code in bioql PyPI...

Sensitive Information Disclosure

@backstage/plugin-scaffolder-backend is vulnerable to Sensitive Information Disclosure. The vulnerability is due to duplicate logging of input values in the fetch:template action, which could expose sensitive data if $ secrets.x is used as an argument...

GHSA-3X3Q-GHCP-WHF7 Template Secret leakage in logs in Scaffolder when using `fetch:template`

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the secrets bag could appear in local/server logs when...

Template Secret leakage in logs in Scaffolder when using `fetch:template`

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the secrets bag could appear in local/server logs when...