diff --git a/.changeset/swift-fishes-run.md b/.changeset/swift-fishes-run.md
new file mode 100644
index 0000000000..ee3d1217ed
--- /dev/null
+++ b/.changeset/swift-fishes-run.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Bump minimum required version of `vm2` to be 3.9.17
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index 9653481052..3b4b281a15 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -92,7 +92,7 @@
     "p-queue": "^6.6.2",
     "prom-client": "^14.0.1",
     "uuid": "^8.2.0",
-    "vm2": "^3.9.11",
+    "vm2": "^3.9.17",
     "winston": "^3.2.1",
     "yaml": "^2.0.0",
     "zen-observable": "^0.10.0",
diff --git a/yarn.lock b/yarn.lock
index c32842ef1b..1e7647118f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8049,7 +8049,7 @@ __metadata:
     prom-client: ^14.0.1
     supertest: ^6.1.3
     uuid: ^8.2.0
-    vm2: ^3.9.11
+    vm2: ^3.9.17
     wait-for-expect: ^3.0.2
     winston: ^3.2.1
     yaml: ^2.0.0
@@ -39694,15 +39694,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vm2@npm:^3.9.11":
-  version: 3.9.16
-  resolution: "vm2@npm:3.9.16"
+"vm2@npm:^3.9.17":
+  version: 3.9.17
+  resolution: "vm2@npm:3.9.17"
   dependencies:
     acorn: ^8.7.0
     acorn-walk: ^8.2.0
   bin:
     vm2: bin/vm2
-  checksum: 646b45dca721acb3c8e4ae0742129f13612972387911c2475f3c06ac2b4232000cab0bdaaa65d97d6ea8dc70880e039542618b1b3d04adea79cd94803cbc4ab3
+  checksum: 9a03740a40ab2be5e3348a95fb31512da1a3c85318febb07e5299fa103ff05bcd7b6f458211fa38a1281dc27beccd04ff90355fc1d34fe2ee6ca10d0bb8c6f35
   languageName: node
   linkType: hard