All vulnerabilities
CVE-2026-106500GHSA-xvgh-hmx8-9xxf

@backstage/plugin-scaffolder-backend: Backstage: Improper task state validation in Scaffolder backend

backstage @backstage/plugin-scaffolder-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 4.1.0@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • Restrict Scaffolder task creation and task-read permissions to trusted users through the permission policy.
  • Limit who can register or modify templates and which Scaffolder actions may execute.
  • Run backend application files read-only outside a dedicated, least-privilege Scaffolder working directory.

References

Text from GitHub Advisory Database

Affected versions 9

  • @backstage/plugin-scaffolder-backend, npm< 4.1.0GitHub
  • backstageaffected: < 1.49.6CVE List
  • backstageaffected: >= 1.50.0-next.0, < 1.50.5CVE List
  • backstageaffected: >= 1.51.0-next.0, < 1.54.6CVE List
  • plugin-scaffolder-backendaffected: < 3.3.1CVE List
  • plugin-scaffolder-backendaffected: >= 3.4.0, < 3.4.1CVE List
  • plugin-scaffolder-backendaffected: >= 4.0.0, < 4.0.3CVE List
  • plugin-scaffolder-backendaffected: >= 4.0.4, < 4.1.0CVE List
  • @backstage/plugin-scaffolder-backend, npmfrom first release, fixed in 4.1.0OSV

References 9