Skip to content
OpenAdvisories

Package · npm

@backstage/plugin-scaffolder-backend

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.0
    CVE-2026-29184

    @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

    Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.…

    backstage backstage @backstage/plugin-scaffolder-backend npm
  • Low 2.6
    CVE-2025-55285

    @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

    @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly red…

    backstage backstage @backstage/plugin-scaffolder-backend npm