@backstage/plugin-scaffolder-backend@0.0.0-nightly-20260825023435

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the NunjucksWorkflowRunner in plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts, where a denied scaffolder action causes the runner to throw a NotAllowedError that includes the full serialized action input in the error message. An authenticated attacker who triggers an unauthorized action can read the complete input object - which may contain secrets, tokens, or other sensitive configuration - from the resulting error response.

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall back to server-side integration credentials when no user-supplied token is provided. An authenticated attacker can trigger SCM operations (repository creation, pull request creation, and similar actions) that execute under the server's privileged integration credentials rather than the user's own credentials, allowing privilege escalation across SCM resources. This affects all SCM provider modules in the scaffolder backend, including Bitbucket Server, Bitbucket Cloud, Azure DevOps, and GitHub.

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Incorrect Authorization via the getAuthorizeConditions function in checkPermissions.ts, which fails to enforce DENY authorization decisions when evaluating scaffolder task read permissions. An authenticated attacker can read scaffolder tasks that they have been explicitly denied access to, because the function only handles CONDITIONAL results and silently allows access when the authorization result is DENY.

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Information Exposure via the task list ordering parameter in the scaffolder backend router, where an authenticated user can supply an arbitrary field name as the order query parameter when listing scaffolder tasks. Because the field value is not validated against an allowlist before being used in a database query, this allows an attacker to probe internal database schema details through error responses or ordering behavior, resulting in unauthorized disclosure of sensitive information.

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the NunjucksWorkflowRunner in NunjucksWorkflowRunner.ts, where secret values interpolated into each iteration contexts are not redacted from task logs. When a workflow step uses the each construct and secrets are present in the template context, the resolved iteration values derived from those secrets are written to the task log in plaintext, allowing an attacker with access to task logs to recover secret material. The fix introduces a pre-iteration render pass without secrets to identify secret-derived values and register them as redactions before any logging occurs.

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the collectSecretRedactions function in NunjucksWorkflowRunner.ts, which fails to redact secret values from task step logs under certain conditions. The logger is initialised after an early-exit check, meaning secrets are not registered for redaction when a task is cancelled or encounters an error before the logger is created. Additionally, the diffing logic in collectSecretRedactions compares object entries by index rather than by key, causing secret-influenced values to be missed when the rendered object's key order differs between the secrets-present and secrets-absent renders, allowing secret values to appear in plain text in scaffolder task logs.

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Race Condition via the retryTask method in DatabaseTaskStore.ts, where a task retry operation is performed without first validating that the task is in a terminal state. An authenticated attacker can trigger a retry on a task that is currently open or processing, causing the task's status to be reset to open and its event history to be manipulated, potentially leading to unauthorized re-execution of scaffolder tasks with elevated privileges and full confidentiality, integrity, and availability impact on downstream systems.

Upgrade @backstage/plugin-scaffolder-backend to version 3.3.1, 3.4.1, 4.0.3, 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the task serialization logic in router.ts, which previously included secrets and state fields in API responses for task retrieval endpoints. An authenticated attacker can read task secrets - such as credentials or tokens stored in scaffolder task context - by querying the task list or task detail endpoints, as these fields were included in the serialized response without being stripped.

Upgrade @backstage/plugin-scaffolder-backend to version 3.3.1, 3.4.1, 4.0.3, 4.1.0 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the log redaction mechanism in task event logs. An attacker can access sensitive session tokens by registering a malicious template in the catalog and having a victim execute it.

Upgrade @backstage/plugin-scaffolder-backend to version 3.1.4 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Symlink Attack via multiple actions, including debug:log, fs:delete, and archive extraction. A user who create and execute Scaffolder templates can read, delete, or write arbitrary files outside the intended workspace.

Upgrade @backstage/plugin-scaffolder-backend to version 2.2.2, 3.0.2, 3.1.1 or higher.

@backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the fetch:template action, which duplicates logging of the input values. An attacker can access sensitive information by reviewing logs where secrets may not have been properly redacted.

Note: This is only exploitable if ${{ secrets.x }} are passed as arguments to fetch:template.

Upgrade @backstage/plugin-scaffolder-backend to version 2.1.1 or higher.