CVE-2023-35926: Insecure Sandbox in Backstage Scaffolder Plugin
Summary
CVE-2023-35926: Backstage Scaffolder plugin has insecure sandbox. Affects @backstage/plugin-scaffolder-backend versions < 1.15.0. Fixed in 1.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Backstage scaffolder-backend plugin is a component of the Backstage platform, which is an open-source developer portal used for building and managing software projects. The scaffolder-backend plugin provides functionality for generating project templates based on predefined templates. It uses a templating library that requires a sandbox to execute the templates safely. However, the previous sandbox library used, vm2, had known vulnerabilities and potential unfixed vulnerabilities. As a result, the plugin has switched to a different sandbox library to address these security concerns.
Vulnerability Detail
The vulnerability in the Backstage scaffolder-backend plugin allows a malicious actor with write access to a registered scaffolder template to inject code that can be executed on the scaffolder-backend instance. This code injection is possible due to the insecure sandbox used by the plugin. The vulnerability can be exploited by manipulating the template YAML definition itself, but not through user input data. The impact of this vulnerability is remote code execution on the scaffolder-backend instance, which can lead to unauthorized access, data breaches, and other malicious activities.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.0
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@1.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, the Backstage Threat Model recommends controlling access to scaffolder templates and performing manual reviews of changes to the templates. This can help identify any malicious code injection attempts and mitigate the risk of exploitation.
Conclusion
The Backstage scaffolder-backend plugin has been found to have an insecure sandbox, which can be exploited by a malicious actor to execute remote code on the scaffolder-backend instance. To mitigate this vulnerability, it is crucial to update the @backstage/plugin-scaffolder-backend package to version 1.15.0 or later. Additionally, controlling access to scaffolder templates and performing manual reviews of changes can help prevent code injection attempts. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
The Backstage scaffolder-backend plugin is a component of the Backstage platform that provides functionality for generating project templates based on predefined templates. It is used to streamline the process of creating new software projects.
The vulnerability occurs due to the use of an insecure sandbox in the plugin. This allows a malicious actor to inject code into a registered scaffolder template, which can then be executed on the scaffolder-backend instance.
The impact of this vulnerability is remote code execution on the scaffolder-backend instance. This can lead to unauthorized access, data breaches, and other malicious activities.
Yes, the vulnerability has been fixed in version 1.15.0 of the @backstage/plugin-scaffolder-backend package. It includes a switch to a different sandbox library that addresses the insecure sandbox issue.
To protect your application, it is recommended to update the @backstage/plugin-scaffolder-backend package to version 1.15.0 or later. This will ensure that the vulnerability is patched and the code execution risk is mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
