NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

CVE-2024-53983 — @backstage/plugin-scaffol…

MEDIUM

CVE-2024-53983 is a medium-severity (CVSS 5.4) Server-Side Request Forgery (SSRF) vulnerability in @backstage/plugin-scaffolder-node. A fix is available for @backstage/plugin-scaffolder-node — see the affected versions and patch details below.

Server-side request forgery in Backstage Scaffolder plugin

Also known asGHSA-qmc2-jpr5-7rg9
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-53983.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs30th percentile — riskier than 30% of all scored CVEsHighest risk
0.00%0.29%0.58%0.87%0.1%0.4%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

151other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@backstage/plugin-scaffolder-nodenpm
97Kdownloads / week

Description

Impact

A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin.

Patches

The issue has been resolved in versions v0.4.12, v0.5.1 and v0.6.1 of the @backstage/plugin-scaffolder-node package. Users are encouraged to upgrade to this version to mitigate the vulnerability.

Workarounds

Users can ensure that templates do not change git config.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
📦npm@backstage/plugin-scaffolder-nodeall versions0.4.12npm install @backstage/plugin-scaffolder-node@0.4.12
📦npm@backstage/plugin-scaffolder-node≥ 0.5.0&&< 0.5.10.5.1npm install @backstage/plugin-scaffolder-node@0.5.1
📦npm@backstage/plugin-scaffolder-node≥ 0.6.0&&< 0.6.10.6.1npm install @backstage/plugin-scaffolder-node@0.6.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @backstage/plugin-scaffolder-node, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @backstage/plugin-scaffolder-node to 0.4.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-53983 is resolved across your whole dependency graph.

  3. Workarounds

    Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

### Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin. ### Patches The issue has been resolved in versions
O3 Security · Impact-Aware SCA

Is CVE-2024-53983 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-53983: @backstage/plugin — Fixed in 0.4.12