Description
Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been patched in version 3.1.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| backstage | backstage | < 3.1.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @backstage/plugin-scaffolder-backend | < 3.1.4 | 3.1.4 | GHSA-8qp7-fhr9-fw53 |