CVE-2026-106506

A flaw was found in plugin-scaffolder-backend. This vulnerability allows an authenticated user with permission to create and view tasks to access confidential task secrets, resulting in information disclosure. Due to improper input validation in task list ordering, an attacker can submit repeated...

GHSA-G734-FHP4-7MFP Backstage: Improper input validation in Sentry scaffolder actions

Impact An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. Patches Upgrade...

EUVD-2026-93993

Backstage: Improper input validation in Sentry scaffolder actions...

External Control of File Name or Path

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to External Control of File Name or Path via the getAndWriteAttachments function in...

GHSA-2CMG-V53W-8XFP Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

Directory Traversal

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where...

Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-gitlab (>=0.0.0-nightly-20240929023448, <=0.11.3-next.2)

@backstage/plugin-scaffolder-backend-module-gitlab NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =4.3.2, =0.3.3, =0.3.4 and more Source...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20231213021616, <=3.1.3-next.2) potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-azure (>=0.0.0-nightly-20240929023448, <=0.2.18-next.1)

@backstage/plugin-scaffolder-backend-module-azure NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20231213021616, =3.1.3-next.2 Source cves: CVE-2026-106462 Source advisory: OSV:GHSA-29GX-H2M3-XW44...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20231213021616, <=3.1.3-next.2) potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-azure (>=0.0.0-nightly-20240929023448, <=0.2.18-next.1)

@backstage/plugin-scaffolder-backend-module-azure NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20231213021616, =3.1.3-next.2 Source cves: CVE-2026-106462 Source advisory: GHSA-29GX-H2M3-XW44...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-gitlab (>=0.0.0-nightly-20240929023448, <=0.11.3-next.2)

@backstage/plugin-scaffolder-backend-module-gitlab NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =4.3.2, =0.3.3, =0.3.4 and more Source...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106462 Source advisory: OSV:GHSA-29GX-H2M3-XW44...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106462 Source advisory: GHSA-29GX-H2M3-XW44...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-github (>=0.0.0-nightly-20240929023448, <=0.9.6-next.2)

@backstage/plugin-scaffolder-backend-module-github NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =4.3.2, =0.3.3, =0.3.4 and more Source cves: CVE-20...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-github (>=0.0.0-nightly-20240929023448, <=0.9.6-next.2)

@backstage/plugin-scaffolder-backend-module-github NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =4.3.2, =0.3.3, =0.3.4 and more Source cves: CVE-20...

EUVD-2026-94003

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: OSV:GHSA-G8RX-F7M5-7794...