Detections
Analytics

SCA: security update for @backstage/plugin-scaffolder-backend (GHSA-pvv8-8fx9-h673)

medium Tenable Self-Hosted Container Security Plugin ID 417724

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Backstage is an open platform for building developer portals. In affected versions A malicious actor could
 read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by
 crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source
 path. When the template is executed the sensitive files would be included in the published pull request.
 This vulnerability is mitigated by the fact that an attacker would need access to create and register
 templates in the Backstage catalog, and that the attack is very visible given that the exfiltration
 happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-
 scaffolder-backend`. (CVE-2021-41151)

See Also

https://github.com/advisories/GHSA-pvv8-8fx9-h673

Plugin Details

Severity: Medium

ID: 417724

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-41151

CVSS v3

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2021

Vulnerability Publication Date: 10/18/2021

Reference Information

CVE: CVE-2021-41151

cwe: CWE-22