1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
backstage-plugin-scaffolder-backend-module-github
Ecosystem: npm
Downloads: 431.2 K
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting backstage-plugin-scaffolder-backend-module-github, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-29gx-h2m3-xw44 | Moderate | Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback### Impact Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended. ### Patches - `@backstage/plugin-scaffolder-backend` version `4.1.0` - `@backstage/plugin-scaffolder-backend-module-azure` version `0.2.25` - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` - `@backstage/plugin-scaffolder-backend-module |
| GitHub (opens in a new tab) |
- GHSA-29gx-h2m3-xw44ModerateBackstage's scaffolder credential handling may allow unintended GitHub authentication fallback
< 0.9.13
### Impact Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended. ### Patches - `@backstage/plugin-scaffolder-backend` version `4.1.0` - `@backstage/plugin-scaffolder-backend-module-azure` version `0.2.25` - `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10` - `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25` - `@backstage/plugin-scaffolder-backend-module
CVE: CVE-2026-106462