-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the use of vm2 library for sandboxing template execution. The commit diff shows replacement of vm2 with isolated-vm in SecureTemplater.ts, indicating this was the vulnerable implementation point. While the exact function name isn't shown in the diff, the SecureTemplater class is directly responsible for sandboxed template execution. The CWE-94 (Code Injection) classification and advisory details confirm this was an insecure code generation control issue in the sandbox implementation. The high confidence comes from: 1) Explicit library replacement in the patch, 2) CWE mapping to code injection in templating, 3) Advisory stating RCE via template manipulation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend | npm | < 1.15.0 | 1.15.0 |