CVE-2026-32237

Backstage vulnerability CVE-2026-32237 affects the @backstage/plugin-scaffolder-backend prior to 3.1.5. Authenticated users with permission to run scaffolder dry-runs can access server-configured environment secrets via the dry-run API response; secrets are redacted in logs but not in all respons...

CVE-2026-32237: Exposure of Sensitive Information to an Unauthorized Actor

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly redacted in log output but not in all...

CVE-2026-24046: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2025-55285: Insertion of Sensitive Information into Log File

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

Arbitrary Code Injection

@backstage/plugin-scaffolder-backend is vulnerable to Arbitrary Code Injection. The vulnerability exists due to sandbox bypass in ScaffolderEntitiesProcessor.js, which allows an attacker with write access to a registered scaffolder template to inject code through the YAML template definition...

CVE-2023-35926

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...

@frontside/backstage-plugin-humanitec-backend (>=0.1.0, <=0.2.1-changeset-release-main.1) potentially affected by CVE-2023-35926 via @backstage/plugin-scaffolder-backend (1.1.0)

@backstage/plugin-scaffolder-backend NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-backend and may be impacted: - @frontside/backstage-plugin-humanitec-backend =0.1.0, =0.2.1-changeset-release-main.1...

RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution. Impact A malicious actor with write access to a registered scaffolder template...

@backstage/plugin-scaffolder-backend-module-confluence-to-markdown (>=0.0.0-nightly-20230325022054, <=0.0.0-nightly-20230801022410), @backstage/plugin-scaffolder-backend-module-cookiecutter (>=0.0.0-nightly-2021101022158, <=0.1.0) +3 more potentially affected by unknown CVE via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041, <=0.14.2)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2021101022158, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230123022600 Source cves: unknown CVE Source...

Path Traversal in @backstage/plugin-scaffolder-backend

Impact A malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance. This vulnerability can in some situation also be exploited through user input when executing a...

CVE-2021-43783 Path Traversal in @backstage/plugin-scaffolder-backend

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend...

CVE-2021-43783: Improper Limitation of a Pathname to a Restricted Directory

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend...

CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

CVE-2021-41151: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...