@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25153 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15166604...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25153 Source advisory: MEND:CVE-2026-25153...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25153 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15166604...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25153 Source advisory: MEND:CVE-2026-25153...

CVE-2026-25153

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with "runIn: local", a malicious actor w...

CVE-2026-25153: Improper Control of Generation of Code

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...

CVE-2026-25152: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.0-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.0-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.3.15-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.3.14-next.1, =0.0.0-nightly-20251123025211, =0.2.14-next.1, =0.2.14-next.1, =0.2.14-next.1, =0.9.1-next.1,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +248 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.12.1-next.1)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =0.3.6, =2.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.0.0 - @aws/amazon-ecr-plugin-for-backstage 0.1.2 and more Source cves: CVE-2026-24046 Source advisory:...

Symlink Attack

Overview @backstage/plugin-scaffolder-node is a The plugin-scaffolder-node module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via multiple actions, including debug:log, fs:delete, and archive extraction. A user who create and execute...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041, <=1.33.0)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-202110122318, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2021101022158, =0.0.0-nightly-2021101022158, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2021101022158,...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/backstage-plugin-scaffolder-backend-module-aws-core (>=0.2.14, <=0.2.16) +143 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.0.0-nightly-20240929023448, <=0.11.1-next.0)

@backstage/plugin-scaffolder-node NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.2.14, =0.3.6, =0.2.6, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.0, =0.4.0, =0.4.1 - @backstage-community/backstage-plugin-scaffolder-backend-module-mta 0.4.0 and more Source cves:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.7.8-next.2), @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20251123025211, <=3.1.1-next.2) +16 more potentially affected by CVE-2026-24046 via @backstage/plugin-scaffolder-node (>=0.12.1-next.0, <=0.12.3-next.0)

@backstage/plugin-scaffolder-node NPM version =0.12.1-next.0, =0.0.0-nightly-20251122024148, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.3.16-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.3.15-next.0, =0.0.0-nightly-20251123025211, =0.2.15-next.0, =0.2.15-next.0, =0.2.15-next.0, =0.9.2-next.0,...

CVE-2026-24046: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

@jamietanna/patch-testing (>=0.1.0, <=0.2.28), @jamietanna/renovate-graph (>=0.24.0, <=0.30.0) +1 more potentially affected by unknown CVE via renovate (>=39.60.0, <=40.21.2)

renovate NPM version =39.60.0, =0.1.0, =0.24.0, =0.5.3, =1.0.1 Source cves: unknown CVE Source advisory: GHSA-XJR7-3C3G-M763...

@jamietanna/renovate-graph (>=0.24.0, <=0.30.0), @secustor/backstage-plugin-renovate-backend-module-runtime-direct (>=0.6.5, <=1.0.1) potentially affected by unknown CVE via renovate (>=39.230.2, <=40.21.2)

renovate NPM version =39.230.2, =0.24.0, =0.6.5, =1.0.1 Source cves: unknown CVE Source advisory: GHSA-XV56-3WQ5-9997...