Homepage

@backstage/plugin-scaffolder-backend-module-github@0.0.0-nightly-20260508031713

The github module for @backstage/plugin-scaffolder-backend

  • latest version

    0.10.0

  • latest non vulnerable version

    0.10.1-next.1

  • first published

    2 years ago

  • latest version published

    1 months ago

  • View plugin-scaffolder-backend-module-github package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @backstage/plugin-scaffolder-backend-module-github package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Incorrect Authorization

    @backstage/plugin-scaffolder-backend-module-github is a The github module for @backstage/plugin-scaffolder-backend

    Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall back to server-side integration credentials when no user-supplied token is provided. An authenticated attacker can trigger SCM operations (repository creation, pull request creation, and similar actions) that execute under the server's privileged integration credentials rather than the user's own credentials, allowing privilege escalation across SCM resources. This affects all SCM provider modules in the scaffolder backend, including Bitbucket Server, Bitbucket Cloud, Azure DevOps, and GitHub.

    How to fix Incorrect Authorization?

    Upgrade @backstage/plugin-scaffolder-backend-module-github to version 0.9.13 or higher.

    <0.9.13
    Go back to all versions of this package