{"action":"Upgrade @backstage/integration to 1.20.1 or later.","affected":[{"fixed":"1.20.1","introduced":"0"}],"component":"@backstage/integration","cve_ids":["CVE-2026-29185"],"ecosystem":"npm","epss":0.0037,"exploited":false,"fixed_versions":["1.20.1"],"ghsa_id":"GHSA-95v5-prp4-5gv5","id":"tcs_01M5KFEXW0XK4AJTZAE286P42C","modified_at":"2026-03-09T16:01:24.192125Z","published_at":"2026-03-05T00:20:45Z","references":["https://osv.dev/vulnerability/GHSA-95v5-prp4-5gv5","https://github.com/backstage/backstage/security/advisories/GHSA-95v5-prp4-5gv5","https://nvd.nist.gov/vuln/detail/CVE-2026-29185","https://github.com/backstage/backstage"],"severity":{"label":"low","score":2.7},"sources":[{"source":"osv","source_id":"GHSA-95v5-prp4-5gv5","url":"https://osv.dev/vulnerability/GHSA-95v5-prp4-5gv5"}],"summary":"Backstage vulnerable to potential reading of SCM URLs using built in token"}