CVE-2023-35926

The CVE-2023-35926 issue affects Backstage: the scaffolder-backend plugin used a sandboxed templating library that previously relied on vm2 and recently switched to a different sandbox. The vulnerability arises when a malicious actor with write access to a registered scaffolder template can manip...

CVE-2023-35926 Insecure sandbox in Backstage Scaffolder plugin

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...

CVE-2023-35926 Insecure sandbox in Backstage Scaffolder plugin

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...

@frontside/backstage-plugin-humanitec-backend (>=0.1.0, <=0.2.1-changeset-release-main.1) potentially affected by CVE-2023-35926 via @backstage/plugin-scaffolder-backend (1.1.0)

@backstage/plugin-scaffolder-backend NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-backend and may be impacted: - @frontside/backstage-plugin-humanitec-backend =0.1.0, =0.2.1-changeset-release-main.1...