GHSA-2g8g-63j4-9w3r: 
JavaScript vulnerability analysis and mitigation

A high-severity Remote Code Execution (RCE) vulnerability was discovered in the @backstage/plugin-scaffolder-backend package, affecting versions prior to 0.15.14. The vulnerability was disclosed on November 26, 2021, and involves the templating library used by the scaffolder backend, which incorrectly assumed templates were trusted (GitHub Advisory).

The vulnerability stems from a security flaw in the templating system where template code execution was not properly sandboxed. This issue was identified and tracked as GHSA-2g8g-63j4-9w3r. The vulnerability received a High severity rating, though no specific CVSS score was assigned, and no CVE ID was allocated (GitHub Advisory).

The vulnerability could allow a malicious actor with write access to a registered scaffolder template to execute remote code on the scaffolder-backend instance. Importantly, the vulnerability was only exploitable through the template yaml definition itself and not through user input data (GitHub Advisory).

The vulnerability has been patched in version 0.15.14 of @backstage/plugin-scaffolder-backend. The fix involved implementing proper sandboxing for template code execution. Users are advised to upgrade to this version or later to protect against potential exploitation (GitHub Advisory).