Homepage

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud@0.3.6

The Bitbucket Cloud module for @backstage/plugin-scaffolder-backend

  • latest version

    0.3.11

  • latest non vulnerable version

    0.3.12-next.1

  • first published

    2 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View plugin-scaffolder-backend-module-bitbucket-cloud package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @backstage/plugin-scaffolder-backend-module-bitbucket-cloud package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Symlink Attack

    @backstage/plugin-scaffolder-backend-module-bitbucket-cloud is a The Bitbucket Cloud module for @backstage/plugin-scaffolder-backend

    Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts (and the corresponding Bitbucket Cloud action), where fs.cpSync is used with the recursive: true option to copy source files into a temporary directory. Node's native fs.cpSync follows symbolic links when copying recursively, allowing an attacker who controls the source repository contents to include symlinks that escape the intended workspace boundary and read or overwrite arbitrary files on the server.

    How to fix Symlink Attack?

    Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to version 0.3.10 or higher.

    <0.3.10
    • M
    Incorrect Authorization

    @backstage/plugin-scaffolder-backend-module-bitbucket-cloud is a The Bitbucket Cloud module for @backstage/plugin-scaffolder-backend

    Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall back to server-side integration credentials when no user-supplied token is provided. An authenticated attacker can trigger SCM operations (repository creation, pull request creation, and similar actions) that execute under the server's privileged integration credentials rather than the user's own credentials, allowing privilege escalation across SCM resources. This affects all SCM provider modules in the scaffolder backend, including Bitbucket Server, Bitbucket Cloud, Azure DevOps, and GitHub.

    How to fix Incorrect Authorization?

    Upgrade @backstage/plugin-scaffolder-backend-module-bitbucket-cloud to version 0.3.10 or higher.

    <0.3.10
    Go back to all versions of this package