- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 16 · 1 critical, 5 high, 8 medium, 2 low
- Weekly downloads
- 179K
- Dependents
- 2
- Registry
- npm
Advisories 16
- CVE-2026-106506Medium 5.3
Backstage: Improper input validation in scaffolder task list ordering
Affected: fixed in 4.1.0.
- CVE-2026-106504Medium 6.5
Backstage: Sensitive information exposure in scaffolder task logs
Affected: fixed in 4.1.0.
- CVE-2026-106503High 8.1
Backstage: Scaffolder action input authorization bypass
Affected: fixed in 3.3.1; from 3.4.0, fixed in 3.4.1; from 4.0.0, fixed in 4.0.3; from 4.0.4, fixed in 4.1.0.
- CVE-2026-106502Medium 5.3
Backstage: Sensitive information may be exposed in Scaffolder task failure events
Affected: fixed in 4.1.0.
- CVE-2026-106501Critical 9.6
Backstage: Sensitive information exposure in Scaffolder
Affected: fixed in 3.3.1; from 3.4.0, fixed in 3.4.1; from 4.0.0, fixed in 4.0.3; from 4.0.4, fixed in 4.1.0.
- CVE-2026-106500High 8.5
Backstage: Improper task state validation in Scaffolder backend
Affected: fixed in 4.1.0.
- CVE-2026-106499Medium 4.9
Backstage: Secret-derived values may be exposed in scaffolder task logs
Affected: fixed in 4.1.0.
- CVE-2026-106462Medium 6.4
Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
Affected: fixed in 4.1.0.
- CVE-2026-106461Medium 4.3
Backstage: Incorrect authorization in scaffolder task listing
Affected: fixed in 4.1.0.
- CVE-2026-32237Medium 4.4
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
Affected: from 3.1.0, fixed in 3.1.5.
- CVE-2026-29184Low 2.0
@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass
Affected: fixed in 3.1.4.
- CVE-2026-24046High 7.1
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Affected: fixed in 2.2.2; from 3.0.0, fixed in 3.0.2; from 3.1.0, fixed in 3.1.1.
- CVE-2025-55285Low 2.6
@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`
Affected: fixed in 2.1.1.
- CVE-2023-35926High 8.1
Insecure sandbox in Backstage Scaffolder plugin
Affected: fixed in 1.15.0.
- CVE-2021-43783High 8.5
Path Traversal in @backstage/plugin-scaffolder-backend
Affected: fixed in 0.15.14.
- CVE-2021-41151Medium 6.8
Path Traversal in @backstage/plugin-scaffolder-backend
Affected: from 0.9.4, fixed in 0.15.9.