Security
فارسی
All products

@backstage/plugin-scaffolder-backend

npm · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Backstage: Incorrect authorization in scaffolder task listingCVE-2026-106461 · GHSA-7HFW-GRCM-CQM6 @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat Medium Fix reported
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallbackCVE-2026-106462 · GHSA-29GX-H2M3-XW44 @backstage/plugin-scaffolder-backend-module-azure@backstage/plugin-scaffolder-backend-module-bitbucket-cloud npmRed Hat Medium Fix reported
Backstage: Scaffolder action input authorization bypassCVE-2026-106503 · GHSA-HMP2-4M7G-22CV @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat High Fix reported
Backstage: Sensitive information exposure in ScaffolderCVE-2026-106501 · GHSA-G2V8-7JHW-PP8P @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat Critical Fix reported
Backstage: Secret-derived values may be exposed in scaffolder task logsCVE-2026-106499 · GHSA-MFVQ-X7VR-RGQG @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat Medium Fix reported
Backstage: Improper task state validation in Scaffolder backendCVE-2026-106500 · GHSA-XVGH-HMX8-9XXF @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat High Fix reported
Backstage may expose sensitive information in Scaffolder task failure eventsCVE-2026-106502 · GHSA-95P4-VV4G-JXXM @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat Medium Fix reported
Backstage has sensitive information exposure in scaffolder task logsCVE-2026-106504 · GHSA-4XVQ-3M68-H444 @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat Medium Fix reported
Backstage has improper input validation in scaffolder task list orderingCVE-2026-106506 · GHSA-VWP5-F99X-X3RQ @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend npmRed Hat Medium Fix reported
Backstage Scaffolder plugin has insecure sandboxCVE-2023-35926 · GHSA-WG6P-JMPC-XJMR @backstage/plugin-scaffolder-backend npm High Fix reported
Path Traversal in @backstage/plugin-scaffolder-backendCVE-2021-43783 · GHSA-MG3M-F475-28HV @backstage/plugin-scaffolder-backend npm High Fix reported
Path Traversal in @backstage/plugin-scaffolder-backend CVE-2021-41151 · GHSA-PVV8-8FX9-H673 @backstage/plugin-scaffolder-backend npm Medium Fix reported
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpointCVE-2026-32237 · GHSA-8WQ8-6859-QX77 @backstage/plugin-scaffolder-backendSelf-service automation portal 2/ansible-automation-platform/automation-portal npmRed Hat Medium Fix reported
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction BypassCVE-2026-29184 · GHSA-8QP7-FHR9-FW53 @backstage/plugin-scaffolder-backendRed Hat Developer Hub 1/rhdh/rhdh-hub-rhel9 npmRed Hat Low Fix reported
Backstage has a Possible Symlink Path Traversal in Scaffolder ActionsCVE-2026-24046 · GHSA-RQ6Q-WR2Q-7PGP @backstage/backend-defaults@backstage/plugin-scaffolder-backend npm High Fix reported
Template Secret leakage in logs in Scaffolder when using `fetch:template`CVE-2025-55285 · GHSA-3X3Q-GHCP-WHF7 @backstage/plugin-scaffolder-backendOpenShift Serverless/openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 npmRed Hat Low Fix reported
RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backendGHSA-2G8G-63J4-9W3R @backstage/plugin-scaffolder-backend npm High Fix reported