@backstage/plugin-scaffolder-backend (npm)
Advisories
25
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.1.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @backstage/plugin-scaffolder-backend@4.1.0yarn
yarn add @backstage/plugin-scaffolder-backend@4.1.0pnpm
pnpm add @backstage/plugin-scaffolder-backend@4.1.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vwp5-f99x-x3rq Backstage has improper input validation in scaffolder task list ordering |
Medium EPSS 0.22% |
< 4.1.0 | 4.1.0 |
| GHSA-4xvq-3m68-h444 Backstage has sensitive information exposure in scaffolder task logs |
Medium EPSS 0.26% |
< 4.1.0 | 4.1.0 |
| GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass |
High EPSS 0.49% |
>= 4.0.4, < 4.1.0 | 4.1.0 |
| GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass |
High EPSS 0.49% |
>= 4.0.0, < 4.0.3 | 4.0.3 |
| GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass |
High EPSS 0.49% |
< 3.3.1 | 3.3.1 |
| GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass |
High EPSS 0.49% |
>= 3.4.0, < 3.4.1 | 3.4.1 |
| GHSA-95p4-vv4g-jxxm Backstage may expose sensitive information in Scaffolder task failure events |
Medium EPSS 0.29% |
< 4.1.0 | 4.1.0 |
| GHSA-g2v8-7jhw-pp8p Backstage: Sensitive information exposure in Scaffolder |
Critical EPSS 0.48% |
>= 4.0.0, < 4.0.3 | 4.0.3 |
| GHSA-g2v8-7jhw-pp8p Backstage: Sensitive information exposure in Scaffolder |
Critical EPSS 0.48% |
< 3.3.1 | 3.3.1 |
| GHSA-g2v8-7jhw-pp8p Backstage: Sensitive information exposure in Scaffolder |
Critical EPSS 0.48% |
>= 3.4.0, < 3.4.1 | 3.4.1 |
| GHSA-g2v8-7jhw-pp8p Backstage: Sensitive information exposure in Scaffolder |
Critical EPSS 0.48% |
>= 4.0.4, < 4.1.0 | 4.1.0 |
| GHSA-xvgh-hmx8-9xxf Backstage: Improper task state validation in Scaffolder backend |
High EPSS 0.34% |
< 4.1.0 | 4.1.0 |
| GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs |
Medium EPSS 0.27% |
< 4.1.0 | 4.1.0 |
| GHSA-29gx-h2m3-xw44 Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback |
Medium EPSS 0.17% |
< 4.1.0 | 4.1.0 |
| GHSA-7hfw-grcm-cqm6 Backstage: Incorrect authorization in scaffolder task listing |
Medium EPSS 0.19% |
< 4.1.0 | 4.1.0 |
| GHSA-8wq8-6859-qx77 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint |
Medium EPSS 0.26% |
>= 3.1.0, < 3.1.5 | 3.1.5 |
| GHSA-8qp7-fhr9-fw53 @backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass |
Medium EPSS 0.28% |
< 3.1.4 | 3.1.4 |
| GHSA-rq6q-wr2q-7pgp Backstage has a Possible Symlink Path Traversal in Scaffolder Actions |
High EPSS 0.53% |
< 2.2.2 | 2.2.2 |
| GHSA-rq6q-wr2q-7pgp Backstage has a Possible Symlink Path Traversal in Scaffolder Actions |
High EPSS 0.53% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-rq6q-wr2q-7pgp Backstage has a Possible Symlink Path Traversal in Scaffolder Actions |
High EPSS 0.53% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-3x3q-ghcp-whf7 Template Secret leakage in logs in Scaffolder when using `fetch:template` |
Low EPSS 0.24% |
< 2.1.1 | 2.1.1 |
| GHSA-wg6p-jmpc-xjmr Backstage Scaffolder plugin has insecure sandbox |
Critical EPSS 1.89% |
< 1.15.0 | 1.15.0 |
| GHSA-2g8g-63j4-9w3r RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend |
High | < 0.15.14 | 0.15.14 |
| GHSA-mg3m-f475-28hv Path Traversal in @backstage/plugin-scaffolder-backend |
High EPSS 1.25% |
< 0.15.14 | 0.15.14 |
| GHSA-pvv8-8fx9-h673 Path Traversal in @backstage/plugin-scaffolder-backend |
Medium EPSS 1.31% |
>= 0.9.4, < 0.15.9 | 0.15.9 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor