RCE vulnerability in @backstage/plugin-scaffolder-backend
Summary
GHSA-2g8g-63j4-9w3r: RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend. Affects @backstage/plugin-scaffolder-backend versions < 0.15.14. Fixed in 0.15.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend is a package that provides scaffolding functionality for the Backstage platform. It allows users to generate project templates and boilerplate code based on predefined templates. The package utilizes a templating library to process and render these templates. However, a vulnerability has been discovered in the v1beta3 templates, where the templating library assumes that templates are trusted. This undesired property could be exploited by a malicious actor with write access to a registered scaffolder template.
Vulnerability Detail
The RCE (Remote Code Execution) vulnerability in @backstage/plugin-scaffolder-backend allows an attacker to execute arbitrary code on the scaffolder-backend instance. The vulnerability arises from the assumption that templates are trusted, which enables an attacker to manipulate the template code and inject malicious code. This vulnerability can only be exploited through the template yaml definition itself and not by user input data. The impact of this vulnerability is significant as it could lead to unauthorized code execution and potential compromise of the scaffolder-backend instance.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.15.14
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@0.15.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The RCE vulnerability in @backstage/plugin-scaffolder-backend poses a significant risk to the security and integrity of the scaffolder-backend instance. It is crucial to update to version 0.15.14 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
@backstage/plugin-scaffolder-backend is a package that provides scaffolding functionality for the Backstage platform. It allows users to generate project templates and boilerplate code based on predefined templates.
The RCE vulnerability occurs due to the assumption that templates are trusted in the v1beta3 templates used by the scaffolder backend. This allows a malicious actor with write access to a registered scaffolder template to manipulate the template code and inject malicious code.
The impact of the RCE vulnerability is significant as it allows for remote code execution on the scaffolder-backend instance. An attacker could execute arbitrary code, potentially leading to unauthorized access, data compromise, or disruption of services.
No, the RCE vulnerability can only be exploited through the template yaml definition itself and not by user input data.
To mitigate the RCE vulnerability, it is recommended to update to version 0.15.14 of @backstage/plugin-scaffolder-backend. This version includes a patch that sandboxes the template code execution, preventing unauthorized code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
