Skip to content
OpenAdvisories

Package · npm

@backstage/plugin-scaffolder-node

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.1
    CVE-2026-24046 Public exploit

    Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

    Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…

    backstage backstage @backstage/plugin-scaffolder-backend @backstage/backend-defaults npm
  • Medium 5.4
    CVE-2024-53983

    Server-side request forgery in Backstage Scaffolder plugin

    The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config…

    backstage backstage @backstage/plugin-scaffolder-node npm