TI-2023-17988 Aliases CVE-2023-35926 GHSA-wg6p-jmpc-xjmr

Insecure sandbox in Backstage Scaffolder plugin

MEDIUM 47CWE-94Published 2023-06-22 · Updated 2024-12-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01888 79th percentileScored 2026-11-07

Fix Fixed backstage (backstage): 1.15.0@backstage/plugin-scaffolder-backend (npm): 1.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	backstage	before 1.15.0	1.15.0	Patch available	CNA
—	@backstage/plugin-scaffolder-backend (npm)	before 1.15.0	1.15.0	Patch available	GHSA-wg6p-jmpc-xjmr

backstage Vendorbackstage Affected before 1.15.0 Fixed in 1.15.0 Patch available CNA
@backstage/plugin-scaffolder-backend (npm) Vendor— Affected before 1.15.0 Fixed in 1.15.0 Patch available GHSA-wg6p-jmpc-xjmr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:backstage::::::::	before 1.15.0	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:* Versions before 1.15.0 Vulnerable ·backstage

Remediation

Fix · CNA backstage (backstage) Fixed in 1.15.0
Fix · GHSA-wg6p-jmpc-xjmr @backstage/plugin-scaffolder-backend (npm) Fixed in 1.15.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-35926
2026-10-03 Alias added: GHSA-wg6p-jmpc-xjmr

References

Patch 1

https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a

Advisory 2

Other 2

TI-2026-69075 Sensitive information exposure in Backstage Scaffolder CVSS 3.1CRITICAL 9.6
TI-2026-69061 Path traversal in Backstage Bitbucket pull-request scaffolder actions CVSS 3.1CRITICAL 9.9
TI-2026-60083 Backstage: Improper input validation in TechDocs MkDocs configuration CVSS 3.1HIGH 8.8
TI-2026-69165 Backstage TechDocs config flaw allows code execution CVSS 3.1HIGH 8.8
TI-2026-69083 Code injection via MkDocs theme configuration in Backstage TechDocs CVSS 3.1HIGH 8.8
TI-2026-69074 Race condition in Backstage scaffolder backend task handling CVSS 3.1HIGH 8.5

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences