Insertion of Sensitive Information into Log File

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the fetch:template action, which duplicates logging of the input values. An...

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285

The CVE-2025-55285 issue affects the Backstage scaffolder-backend plugin. Before version 2.1.1, the fetch:template action could duplicate the input log path, causing some secrets passed via the {{ secrets }} bag to be written to logs instead of being redacted. Affected product: @backstage/plugin-...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

PT-2025-33503 · Backstage · @Backstage/Plugin-Scaffolder-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-scaffolder-backend versions prior to 2.1.1 Description: The backend for the default Backstage software templates exhibited duplicate logging of input values in the fetch:template action within the Scaffolder. This resulted i...

MAL-2025-19919 Malicious code in ev-scaffolder (npm)

The package ev-scaffolder was found to contain malicious code...

Malicious code in cubx-wct-tst-scaffolder (npm)

The package cubx-wct-tst-scaffolder was found to contain malicious code...

Malicious code in ev-scaffolder (npm)

The package ev-scaffolder was found to contain malicious code...

MAL-2025-17817 Malicious code in cubx-wct-tst-scaffolder (npm)

The package cubx-wct-tst-scaffolder was found to contain malicious code...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2023-35926

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...

CVE-2021-43783

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend...

CVE-2025-32791

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission...

CVE-2025-32791

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission...

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.1.1-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021101022158, <=0.0.0-nightly-20260904022803) +25 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.4.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20230325022054,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535) +1 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.6.0)

@backstage/plugin-scaffolder-node NPM version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20241120023536,...

@backstage/backend-dynamic-feature-service (>=0.4.2-next.1, <=0.4.2-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338, <=1.26.0-next.2) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.5.0-next.2)

@backstage/plugin-scaffolder-node NPM version 0.5.0-next.2 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/backend-dynamic-feature-service =0.4.2-next.1, =0.0.0-nightly-20241017023338,...