@backstage-community/plugin-scaffolder-backend-module-amplication (=0.4.0), @backstage-community/plugin-scaffolder-backend-module-annotator (=2.9.0) +33 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448 <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =2.8.0, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2022122206, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.3.14-next.0 and more...

@backstage-community/plugin-scaffolder-backend-module-amplication (=0.4.0), @backstage-community/plugin-scaffolder-backend-module-annotator (=2.9.0) +33 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448 <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =2.8.0, =0.0.0-nightly-20240116021644, =0.0.0-nightly-2022122206, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231213021616, =0.3.14-next.0 and more...

Symlink Attack

Overview @backstage/plugin-scaffolder-node is a The plugin-scaffolder-node module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via multiple actions, including debug:log, fs:delete, and archive extraction. A user who create and execute...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20241120023536 <=0.5.1-next.0), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241120023536 <=1.28.0-next.0) +11 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.6.0 <=0.6.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.6.0, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.1.16-next.0 Source cves: CVE-2024-53983 Source advisory: OSV:GHSA-QMC2-JPR5-7RG9...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10 <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6 <=0.3.9) +106 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448 <=0.3.3)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.5.0, =0.1.0, =0.4.0, =0.4.0, =0.5.0, =0.5.0, =2.1.0, =0.4.0, =2.9.0, =0.12.0, =0.4.0, =0.5.0, =0.14.0 and more Source cves: CVE-202...

@backstage/backend-dynamic-feature-service (>=0.4.4-next.0 <=0.5.0-next.3), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20241017023338 <=1.27.0-next.3) +10 more potentially affected by CVE-2024-53983 via @backstage/plugin-scaffolder-node (>=0.5.0 <=0.5.1-next.3)

@backstage/plugin-scaffolder-node NPM version =0.5.0, =0.4.4-next.0, =0.0.0-nightly-20241017023338, =0.2.2-next.0, =0.3.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.2.2-next.0, =0.4.3-next.0, =0.1.15-next.0, =0.1.15-next.3 Source cves: CVE-2024-53983...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...