tocsin

CVE-2026-24046

3 advisories.

npm/@backstage/backend-defaults CVE-2026-24046: high 7.1, EPSS 0.53%

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Action: Upgrade @backstage/backend-defaults to 0.12.2 or later.

npm i @backstage/backend-defaults@0.12.2
npm i @backstage/backend-defaults@0.13.2
npm i @backstage/backend-defaults@0.14.1

Affected

introducedfixedlast affected
00.12.2-
0.13.00.13.2-
0.14.00.14.1-

Fixed versions

0.12.20.13.20.14.1

Sources

CVE-2026-24046 · published · modified · JSON

npm/@backstage/plugin-scaffolder-backend CVE-2026-24046: high 7.1, EPSS 0.53%

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Action: Upgrade @backstage/plugin-scaffolder-backend to 2.2.2 or later.

npm i @backstage/plugin-scaffolder-backend@2.2.2
npm i @backstage/plugin-scaffolder-backend@3.0.2
npm i @backstage/plugin-scaffolder-backend@3.1.1

Affected

introducedfixedlast affected
02.2.2-
3.0.03.0.2-
3.1.03.1.1-

Fixed versions

2.2.23.0.23.1.1

Sources

CVE-2026-24046 · published · modified · JSON

npm/@backstage/plugin-scaffolder-node CVE-2026-24046: high 7.1, EPSS 0.53%

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Action: Upgrade @backstage/plugin-scaffolder-node to 0.11.2 or later.

npm i @backstage/plugin-scaffolder-node@0.11.2
npm i @backstage/plugin-scaffolder-node@0.12.3

Affected

introducedfixedlast affected
00.11.2-
0.12.00.12.3-

Fixed versions

0.11.20.12.3

Sources

CVE-2026-24046 · published · modified · JSON