CVE-2023-35926

Katalog CVE

CVSS 9.9 · Critical EPSS 1,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada linuxfoundation backstage. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.

Rincian

Terbit di NVD

22 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr advisory vendor
• https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a patch
• https://github.com/backstage/backstage/releases/tag/v1.15.0 release notes