What is GHSA-2g8g-63j4-9w3r?

GHSA-2g8g-63j4-9w3r is a security advisory published by GitHub Security Advisories with High severity. RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend

Why does GHSA-2g8g-63j4-9w3r have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-2g8g-63j4-9w3r?

GHSA-2g8g-63j4-9w3r affects 1 product, including: npm/@backstage/plugin-scaffolder-backend:\u003c 0.15.14.

GHSA-2g8g-63j4-9w3rHighDisclosed before NVD

RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend

Vendor

GitHub Security Advisories

Published

December 1, 2021

Last Modified

January 9, 2023

📋 Description

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.

Impact

A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.

Patches

This is vulnerability is patched in version 0.15.14 of @backstage/plugin-scaffolder-backend.

For more information

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository
Visit our chat, linked to in Backstage README

🎯 Affected products1

npm/@backstage/plugin-scaffolder-backend:< 0.15.14

📋 Description

Impact

Patches

For more information

🎯 Affected products1

🔗 References (2)