Malicious code in backstage-plugin-kubernetes-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d5e128ce958505a3df2acbdc6b87aaf80b05e6b5a1dec494681ab2ceced6a0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in backstage-plugin-kubernetes-backend

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@backstage-community/plugin-rbac-backend (>=5.2.3, <=6.1.1), @janus-idp/backstage-plugin-rbac-backend (>=4.4.2, <=5.2.2) +3 more potentially affected by CVE-2025-32791 via @backstage/plugin-permission-backend (0.5.55)

@backstage/plugin-permission-backend NPM version 0.5.55 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-permission-backend and may be impacted: - @backstage-community/plugin-rbac-backend =5.2.3, =4.4.2, =6.0.1, =0.7.6, =2.0.0, =4.0.0...

@backstage-community/plugin-rbac-backend (>=5.2.3, <=6.1.1), @janus-idp/backstage-plugin-rbac-backend (>=4.4.2, <=5.2.2) +3 more potentially affected by CVE-2025-32791 via @backstage/plugin-permission-backend (0.5.55)

@backstage/plugin-permission-backend NPM version 0.5.55 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-permission-backend and may be impacted: - @backstage-community/plugin-rbac-backend =5.2.3, =4.4.2, =6.0.1, =0.7.6, =2.0.0, =4.0.0...

Server Side Request Forgery (SSRF)

@backstage/plugin-scaffolder-node is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper handling of template functionality in the Backstage Scaffolder plugin, which allows Server-Side Template Injection SSTI to be exploited for Git config injection...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.5.1-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=1.28.0-next.0) +11 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.6.0, <=0.6.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.6.0, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.1.16-next.0 Source cves: CVE-2024-53983 Source advisory: OSV:GHSA-QMC2-JPR5-7RG9...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=0.0.0-nightly-20241121023535) +1 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.6.0)

@backstage/plugin-scaffolder-node NPM version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20241120023536,...

@backstage/backend-dynamic-feature-service (>=0.4.4-next.0, <=0.5.0-next.3), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338, <=1.27.0-next.3) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.5.0, <=0.5.1-next.3)

@backstage/plugin-scaffolder-node NPM version =0.5.0, =0.4.4-next.0, =0.0.0-nightly-20241017023338, =0.2.2-next.0, =0.3.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.4.3-next.0, =0.1.15-next.0, =0.1.15-next.3 Source cves: CVE-2024-53983...

@backstage/plugin-scaffolder-backend (0.0.0-nightly-20241017023338) potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (0.5.0)

@backstage/plugin-scaffolder-node NPM version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-node and may be impacted: - @backstage/plugin-scaffolder-backend 0.0.0-nightly-20241017023338 Source cves: CVE-2024-53983...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.1.1-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021101022158, <=0.0.0-nightly-20260928023907) +25 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.4.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20230325022054,...

@backstage/backend-dynamic-feature-service (>=0.4.4-next.0, <=0.5.0-next.3), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338, <=1.27.0-next.3) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.5.0, <=0.5.1-next.3)

@backstage/plugin-scaffolder-node NPM version =0.5.0, =0.4.4-next.0, =0.0.0-nightly-20241017023338, =0.2.2-next.0, =0.3.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.4.3-next.0, =0.1.15-next.0, =0.1.15-next.3 Source cves: CVE-2024-53983...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240116021644, <=0.1.1-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021101022158, <=0.0.0-nightly-20260928023907) +25 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.4.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20230325022054,...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536, <=0.5.1-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536, <=1.28.0-next.0) +11 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.6.0, <=0.6.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.6.0, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.1.16-next.0 Source cves: CVE-2024-53983 Source advisory: MEND:CVE-2024-53983...

CVE-2024-53983: Server-Side Request Forgery (SSRF)

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-47762

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...

Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

Impact Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret...

GHSA-QC4V-XQ2M-65WC Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

Impact Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret...

CVE-2024-47762: Expected Behavior Violation

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...