GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs

• npm @backstage/plugin-scaffolder-backend: < 4.1.0 → fixed in 4.1.0

Impact Deployments that configure sensitive `scaffolder.defaultEnvironment.secrets` and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs. Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` Workarounds • Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model. • If that restriction cannot be guaranteed, remove sensitive values from `scaffolder.defaultEnvironment.secrets` until a patched version is available. No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.