diff --git a/.changeset/calm-buttons-type.md b/.changeset/calm-buttons-type.md
new file mode 100644
index 0000000000..11b300a684
--- /dev/null
+++ b/.changeset/calm-buttons-type.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Bump minimum required version of `vm2` to be 3.9.18
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index 5bfd276a4f..3d1794410d 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -92,7 +92,7 @@
     "p-queue": "^6.6.2",
     "prom-client": "^14.0.1",
     "uuid": "^8.2.0",
-    "vm2": "^3.9.17",
+    "vm2": "^3.9.18",
     "winston": "^3.2.1",
     "yaml": "^2.0.0",
     "zen-observable": "^0.10.0",
diff --git a/yarn.lock b/yarn.lock
index f91790c2a5..deac1514d8 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8392,7 +8392,7 @@ __metadata:
     prom-client: ^14.0.1
     supertest: ^6.1.3
     uuid: ^8.2.0
-    vm2: ^3.9.17
+    vm2: ^3.9.18
     wait-for-expect: ^3.0.2
     winston: ^3.2.1
     yaml: ^2.0.0
@@ -40203,15 +40203,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vm2@npm:^3.9.17":
-  version: 3.9.17
-  resolution: "vm2@npm:3.9.17"
+"vm2@npm:^3.9.18":
+  version: 3.9.19
+  resolution: "vm2@npm:3.9.19"
   dependencies:
     acorn: ^8.7.0
     acorn-walk: ^8.2.0
   bin:
     vm2: bin/vm2
-  checksum: 9a03740a40ab2be5e3348a95fb31512da1a3c85318febb07e5299fa103ff05bcd7b6f458211fa38a1281dc27beccd04ff90355fc1d34fe2ee6ca10d0bb8c6f35
+  checksum: fc6cf553134145cd7bb5246985bf242b056e3fb5ea71e2eef6710b2a5d6c6119cc6bc960435ff62480ee82efb43369be8f4db07b6690916ae7d3b2e714f395d8
   languageName: node
   linkType: hard