← Vulnerability feed

Vulnerability record · CVE-2023-35926 · published 22 June 2023

CVE-2023-35926: Linuxfoundation backstage code injection vulnerability

Linuxfoundation · Backstage

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.

9.9 CVSS 3.1 Critical EPSS 1.9% · top 21.3% CWE-94 · Code injection
9.9CVSS 3.1 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a Patch
https://github.com/backstage/backstage/releases/tag/v1.15.0 Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr Vendor Advisory
https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a Patch
https://github.com/backstage/backstage/releases/tag/v1.15.0 Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr Vendor Advisory

Track CVE-2023-35926 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-25153Linuxfoundation backstage code injection vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.62%8.5CVE-2021-43783Linuxfoundation backstage path traversal vulnerability@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write a…EPSS 1.2%6.5CVE-2026-25152Linuxfoundation backstage path traversal vulnerabilityBackstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDo…EPSS 0.44%6.5CVE-2024-45815Linuxfoundation backstage prototype pollution vulnerabilityBackstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog b…EPSS 0.51%6.5CVE-2024-45816Linuxfoundation backstage relative path traversal vulnerabilityBackstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access co…EPSS 0.73%6.5CVE-2021-32662Linuxfoundation backstage path traversal vulnerabilityBackstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@back…EPSS 1.3%5.7CVE-2023-6944Redhat red hat developer hub error message information leak vulnerabilityA flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded …EPSS 0.56%5.4CVE-2024-46976Linuxfoundation backstage cross-site scripting vulnerabilityBackstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to in…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2023-35926), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.