CVE-2023-35926

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.

• CWE-94
• CWE-94

• https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949aPatch
• https://github.com/backstage/backstage/releases/tag/v1.15.0Release Notes
• https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmrVendor Advisory
• https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949aPatch
• https://github.com/backstage/backstage/releases/tag/v1.15.0Release Notes
• https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmrVendor Advisory

Published

Jun 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35918Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-3592In Mosquitto before 2.0.16, a memory leak occurs when client…7.5
• CVE-2023-35920A vulnerability has been identified in SIMATIC MV540 H (All …7.5
• CVE-2023-35921A vulnerability has been identified in SIMATIC MV540 H (All …7.5
• CVE-2023-35924GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-35925FastAsyncWorldEdit (FAWE) is designed for efficient world ed…5.5
• CVE-2023-35927NextCloud Server and NextCloud Enterprise Server provide fil…8.1
• CVE-2023-35928Nextcloud Server is a space for data storage on Nextcloud, a…8.8
• CVE-2023-35929Tuleap is a free and open source suite to improve management…5.4
• CVE-2023-3593Mattermost fails to properly validate markdown, allowing an …6.5
• CVE-2023-35930SpiceDB is an open source, Google Zanzibar-inspired, databas…5.3
• CVE-2023-35931Shescape is a simple shell escape library for JavaScript. An…4.3