Snyk vulnerability [SNYK-JS-BACKSTAGEBACKENDDEFAULTS-15054278]

## Affecting Packages/Plugins

* [example-backend](packages/backend/package.json)
* [@backstage/backend-dynamic-feature-service](packages/backend-dynamic-feature-service/package.json)
* [@backstage/backend-test-utils](packages/backend-test-utils/package.json)
* [@techdocs/cli](packages/techdocs-cli/package.json)
* [@backstage/plugin-auth-backend](plugins/auth-backend/package.json)
* [@backstage/plugin-auth-backend-module-aws-alb-provider](plugins/auth-backend-module-aws-alb-provider/package.json)
* [@backstage/plugin-auth-backend-module-github-provider](plugins/auth-backend-module-github-provider/package.json)
* [@backstage/plugin-auth-backend-module-oidc-provider](plugins/auth-backend-module-oidc-provider/package.json)
* [@backstage/plugin-catalog-backend](plugins/catalog-backend/package.json)
* [@backstage/plugin-catalog-backend-module-ai-model](plugins/catalog-backend-module-ai-model/package.json)
* [@backstage/plugin-catalog-backend-module-aws](plugins/catalog-backend-module-aws/package.json)
* [@backstage/plugin-catalog-backend-module-azure](plugins/catalog-backend-module-azure/package.json)
* [@backstage/plugin-catalog-backend-module-backstage-openapi](plugins/catalog-backend-module-backstage-openapi/package.json)
* [@backstage/plugin-catalog-backend-module-bitbucket-cloud](plugins/catalog-backend-module-bitbucket-cloud/package.json)
* [@backstage/plugin-catalog-backend-module-bitbucket-server](plugins/catalog-backend-module-bitbucket-server/package.json)
* [@backstage/plugin-catalog-backend-module-gcp](plugins/catalog-backend-module-gcp/package.json)
* [@backstage/plugin-catalog-backend-module-gerrit](plugins/catalog-backend-module-gerrit/package.json)
* [@backstage/plugin-catalog-backend-module-gitea](plugins/catalog-backend-module-gitea/package.json)
* [@backstage/plugin-catalog-backend-module-github](plugins/catalog-backend-module-github/package.json)
* [@backstage/plugin-catalog-backend-module-github-org](plugins/catalog-backend-module-github-org/package.json)
* [@backstage/plugin-catalog-backend-module-gitlab](plugins/catalog-backend-module-gitlab/package.json)
* [@backstage/plugin-catalog-backend-module-gitlab-org](plugins/catalog-backend-module-gitlab-org/package.json)
* [@backstage/plugin-catalog-backend-module-incremental-ingestion](plugins/catalog-backend-module-incremental-ingestion/package.json)
* [@backstage/plugin-catalog-backend-module-ldap](plugins/catalog-backend-module-ldap/package.json)
* [@backstage/plugin-catalog-backend-module-logs](plugins/catalog-backend-module-logs/package.json)
* [@backstage/plugin-catalog-backend-module-msgraph](plugins/catalog-backend-module-msgraph/package.json)
* [@backstage/plugin-catalog-backend-module-msgraph-incremental](plugins/catalog-backend-module-msgraph-incremental/package.json)
* [@backstage/plugin-catalog-backend-module-openapi](plugins/catalog-backend-module-openapi/package.json)
* [@backstage/plugin-catalog-backend-module-puppetdb](plugins/catalog-backend-module-puppetdb/package.json)
* [@backstage/plugin-catalog-backend-module-scaffolder-entity-model](plugins/catalog-backend-module-scaffolder-entity-model/package.json)
* [@backstage/plugin-catalog-backend-module-unprocessed](plugins/catalog-backend-module-unprocessed/package.json)
* [@backstage/plugin-connections-example-backend](plugins/connections-example-backend/package.json)
* [@backstage/plugin-kubernetes-backend](plugins/kubernetes-backend/package.json)
* [@backstage/plugin-mcp-actions-backend](plugins/mcp-actions-backend/package.json)
* [@backstage/plugin-notifications-backend](plugins/notifications-backend/package.json)
* [@backstage/plugin-notifications-backend-module-email](plugins/notifications-backend-module-email/package.json)
* [@backstage/plugin-notifications-backend-module-slack](plugins/notifications-backend-module-slack/package.json)
* [@backstage/plugin-scaffolder-backend](plugins/scaffolder-backend/package.json)
* [@backstage/plugin-scaffolder-backend-module-azure](plugins/scaffolder-backend-module-azure/package.json)
* [@backstage/plugin-scaffolder-backend-module-bitbucket-cloud](plugins/scaffolder-backend-module-bitbucket-cloud/package.json)
* [@backstage/plugin-scaffolder-backend-module-bitbucket-server](plugins/scaffolder-backend-module-bitbucket-server/package.json)
* [@backstage/plugin-scaffolder-backend-module-confluence-to-markdown](plugins/scaffolder-backend-module-confluence-to-markdown/package.json)
* [@backstage/plugin-scaffolder-backend-module-cookiecutter](plugins/scaffolder-backend-module-cookiecutter/package.json)
* [@backstage/plugin-scaffolder-backend-module-gcp](plugins/scaffolder-backend-module-gcp/package.json)
* [@backstage/plugin-scaffolder-backend-module-gerrit](plugins/scaffolder-backend-module-gerrit/package.json)
* [@backstage/plugin-scaffolder-backend-module-gitea](plugins/scaffolder-backend-module-gitea/package.json)
* [@backstage/plugin-scaffolder-backend-module-github](plugins/scaffolder-backend-module-github/package.json)
* [@backstage/plugin-scaffolder-backend-module-gitlab](plugins/scaffolder-backend-module-gitlab/package.json)
* [@backstage/plugin-scaffolder-backend-module-notifications](plugins/scaffolder-backend-module-notifications/package.json)
* [@backstage/plugin-scaffolder-backend-module-rails](plugins/scaffolder-backend-module-rails/package.json)
* [@backstage/plugin-scaffolder-backend-module-sentry](plugins/scaffolder-backend-module-sentry/package.json)
* [@backstage/plugin-scaffolder-backend-module-workspace-database](plugins/scaffolder-backend-module-workspace-database/package.json)
* [@backstage/plugin-scaffolder-backend-module-yeoman](plugins/scaffolder-backend-module-yeoman/package.json)
* [@backstage/plugin-scaffolder-node-test-utils](plugins/scaffolder-node-test-utils/package.json)
* [@backstage/plugin-search-backend-module-catalog](plugins/search-backend-module-catalog/package.json)
* [@backstage/plugin-search-backend-module-techdocs](plugins/search-backend-module-techdocs/package.json)
* [@backstage/plugin-techdocs-backend](plugins/techdocs-backend/package.json)

## Overview
[@backstage/backend-defaults](https://www.npmjs.org/package/@backstage/backend-defaults) is a Backend defaults used by Backstage backend apps

Affected versions of this package are vulnerable to Symlink Attack via multiple actions, including `debug:log`, `fs:delete`, and archive extraction. A user who create and execute Scaffolder templates can read, delete, or write arbitrary files outside the intended workspace.

## Workaround

This vulnerability can be mitigated by limiting access to template creation and updates, restricting who can execute Scaffolder templates via the permissions framework, auditing existing templates for symlink usage, and running the application in a containerized environment with restricted filesystem access.
## Remediation
Upgrade `@backstage/backend-defaults` to version 0.12.2, 0.13.2, 0.14.1 or higher.
## References
- [GitHub Commit](https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d)
- [Security Recommendations](https://backstage.io/docs/overview/threat-model/#scaffolder)

Start with the affected package.json files listed in the issue and inspect how @backstage/backend-defaults is declared in each. Update the dependency to 0.12.2, 0.13.2, 0.14.1, or a higher compatible version, then run the repository's dependency and package checks. Done means every listed affected package is remediated without introducing dependency conflicts.

Written by the indexing model from the issue text.