GHSA-95p4-vv4g-jxxm: Medium severity npm/@backstage/plugin-scaffolder-backend vulnerability
Impact
Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution.
Patches
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Workarounds
- Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0 - Upgrade
Upgrade
@backstage/plugin-scaffolder-backendto a version that resolves this vulnerability.Fixed in 4.1.0 - Compensating control
Restrict Scaffolder template execution and task-event access to trusted users until version 4.1.0 is deployed.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can execute Scaffolder templates and access task events may be able to retrieve sensitive backend-managed credentials. Exploitation also requires specific template and failure conditions.
Are unauthenticated users affected?
No. The available severity vector indicates that low-level privileges are required, and the advisory describes exploitation by an authenticated user.
What should we do if we cannot immediately upgrade?
Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.
Which version includes the fix?
The issue is patched in @backstage/plugin-scaffolder-backend version 4.1.0.