# Backstage Scaffolder Backend remote code execution in v1beta3 templates

Source: https://junglewise.ai/threats/backstage-scaffolder-backend-remote-code-execution-in-v1beta3-templates-5a4488cb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-01. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: info · Published 2021-12-01

Backstage is an open-source framework used to build developer portals. A security flaw in its scaffolding component, which automates the creation of new software projects, could allow an attacker to execute unauthorized commands on the server. This occurs if an attacker can modify the templates used to generate new projects, potentially leading to a full system takeover or data theft.

Technologies: [Backstage Scaffolder Backend Plugin](https://junglewise.ai/threats/technologies/scaffolder-backend-plugin), [@backstage/plugin-scaffolder-backend (npm)](https://junglewise.ai/threats/technologies/backstage-plugin-scaffolder-backend). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 1 December 2021.

**Which products and versions are affected?** Backstage Scaffolder Backend Plugin < 0.15.14; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=0.15.14.

**Is there a fix for This vulnerability?** Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-scaffolder-backend (npm): upgrade to 0.15.14 or later

  ```sh
  npm install @backstage/plugin-scaffolder-backend@0.15.14
  ```


## Technical details

A remote code execution (RCE) vulnerability exists in the @backstage/plugin-scaffolder-backend package due to the underlying templating library's assumption that all templates are trusted. An attacker with write access to a registered scaffolder template can inject malicious code into the template's YAML definition. Because the template execution was not previously sandboxed, this code runs with the privileges of the scaffolder-backend process. The vulnerability is specifically exploitable through the template definition itself rather than user-provided input data. This issue has been mitigated in version 0.15.14 by implementing sandboxing for template code execution.

## Affected products

- Backstage @backstage/plugin-scaffolder-backend < 0.15.14

## Timeline

- 2021-11-26: advisory: Initial advisory published by maintainers
- 2021-11-29: patched: Fix released in version 0.15.14
- 2021-12-01: disclosed: Public disclosure via GitHub Advisory Database

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-2g8g-63j4-9w3r](https://github.com/backstage/backstage/security/advisories/GHSA-2g8g-63j4-9w3r)
- [https://github.com/backstage/backstage](https://github.com/backstage/backstage)

## Related threats

- [Backstage scaffolder task list input validation vulnerability](https://junglewise.ai/threats/cve-2026-106506-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage scaffolder-backend sensitive information exposure in task logs](https://junglewise.ai/threats/cve-2026-106504-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage Scaffolder Backend authorization bypass in action input validation](https://junglewise.ai/threats/cve-2026-106503-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-scaffolder-backend credential exposure in task events](https://junglewise.ai/threats/cve-2026-106502-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-scaffolder-backend sensitive information exposure](https://junglewise.ai/threats/cve-2026-106501-backstage-is-an-open-framework-for-building-developer-portals)