Description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| backstage | backstage | < 1.54.6 | — |
| @backstage | plugin-scaffolder-backend | < 4.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @backstage/plugin-scaffolder-backend | < 4.1.0 | 4.1.0 | GHSA-95p4-vv4g-jxxm |