Duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If you're not passing through ${{ secrets.x }} to fetch:template there is no impact.
Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write …
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in @backstage/plugin-scaffolder-backend.
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates.This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.
Backstage is an open platform for building developer portals. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack …