@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

Symlink Attack

Overview @backstage/plugin-scaffolder-node is a The plugin-scaffolder-node module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via multiple actions, including debug:log, fs:delete, and archive extraction. A user who create and execute...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041, <=1.33.0)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-202110122318, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2021101022158, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2021101022158,...

CVE-2026-24046: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

@jamietanna/patch-testing (>=0.1.0, <=0.2.28), @jamietanna/renovate-graph (>=0.24.0, <=0.30.0) +1 more potentially affected by unknown CVE via renovate (>=39.60.0, <=40.21.2)

renovate NPM version =39.60.0, =0.1.0, =0.24.0, =0.5.3, =1.0.1 Source cves: unknown CVE Source advisory: GHSA-XJR7-3C3G-M763...

@jamietanna/renovate-graph (>=0.24.0, <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.6.5, <=1.0.1) potentially affected by unknown CVE via renovate (>=39.230.2, <=40.21.2)

renovate NPM version =39.230.2, =0.24.0, =0.6.5, =1.0.1 Source cves: unknown CVE Source advisory: GHSA-XV56-3WQ5-9997...

Malicious Package

Overview backstage-plugin-glean is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

EUVD-2025-205460

Malicious code in backstage-plugin-glean npm...

Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192944 Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-11351

Malicious code in bioql PyPI...

@apollo/chakra-helpers (>=1.1.0, <=2.2.0), @backstage/plugin-apollo-explorer (>=0.0.0-nightly-20220719025614, <=0.1.17) potentially affected by CVE-2025-59845 via @apollo/explorer (>=0.2.1, <=2.0.2)

@apollo/explorer NPM version =0.2.1, =1.1.0, =0.0.0-nightly-20220719025614, =0.1.17 Source cves: CVE-2025-59845 Source advisory: MEND:CVE-2025-59845...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2025-55285 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041, <=1.33.0)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-202110122318, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2021101022158, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2021101022158,...

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285: Insertion of Sensitive Information into Log File

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...