Detections
Analytics

SCA: security update for @backstage/plugin-scaffolder-node (GHSA-qmc2-jpr5-7rg9)

medium Tenable Cloud Security Plugin ID 418206

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A
 vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template
 Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to
 capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized
 access to sensitive resources in git can be achieved. The impact is considered medium severity as the
 Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage
 Catalog plugin. The issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the
 `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate
 the vulnerability. Users are advised to upgrade. Users unable to upgrade may ensure that templates do not
 change git config. (CVE-2024-53983)

See Also

https://github.com/advisories/GHSA-qmc2-jpr5-7rg9

Plugin Details

Severity: Medium

ID: 418206

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:N/A:N

CVSS Score Source: CVE-2024-53983

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.3

Threat Score: 0.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/2/2024

Vulnerability Publication Date: 11/29/2024

Reference Information

CVE: CVE-2024-53983

cwe: CWE-918