RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution. ### Impact A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data. ### Patches This is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`. ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | @backstage/plugin-scaffolder-backend (npm) | before 0.15.14 | 0.15.14 | Patch available | GHSA-2g8g-63j4-9w3r |
- @backstage/plugin-scaffolder-backend (npm) Vendor— Affected before 0.15.14 Fixed in 0.15.14 Patch available GHSA-2g8g-63j4-9w3r
Remediation
- Fix · GHSA-2g8g-63j4-9w3r @backstage/plugin-scaffolder-backend (npm) Fixed in 0.15.14 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-2g8g-63j4-9w3r
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences