Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Backstage: Sensitive information exposure in Scaffolder

Fix availableCritical · CVSS 9.6EPSS 0.48%

Published Oct 7, 2026 · updated Oct 7, 2026

What to do

  1. Upgrade to a fixed version: @backstage/plugin-scaffolder-backend 3.3.1, @backstage/plugin-scaffolder-backend 3.4.1, @backstage/plugin-scaffolder-backend 4.0.3, @backstage/plugin-scaffolder-backend 4.1.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@backstage/plugin-scaffolder-backend

Vulnerable versions
< 3.3.1
Fixed in
3.3.1

Check your project: npm ls @backstage/plugin-scaffolder-backend --all

Is @backstage/plugin-scaffolder-backend@3.3.1 safe to install? See the upgrade verdict →

npm@backstage/plugin-scaffolder-backend

Vulnerable versions
>= 3.4.0, < 3.4.1
Fixed in
3.4.1

Check your project: npm ls @backstage/plugin-scaffolder-backend --all

Is @backstage/plugin-scaffolder-backend@3.4.1 safe to install? See the upgrade verdict →

npm@backstage/plugin-scaffolder-backend

Vulnerable versions
>= 4.0.0, < 4.0.3
Fixed in
4.0.3

Check your project: npm ls @backstage/plugin-scaffolder-backend --all

Is @backstage/plugin-scaffolder-backend@4.0.3 safe to install? See the upgrade verdict →

npm@backstage/plugin-scaffolder-backend

Vulnerable versions
>= 4.0.4, < 4.1.0
Fixed in
4.1.0

Check your project: npm ls @backstage/plugin-scaffolder-backend --all

Is @backstage/plugin-scaffolder-backend@4.1.0 safe to install? See the upgrade verdict →

Sources

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor · CWE-201 Insertion of Sensitive Information Into Sent Data

← All critical vulnerabilities