{"action":"Upgrade @backstage/plugin-scaffolder-backend to 3.3.1 or later.","affected":[{"fixed":"3.3.1","introduced":"0"},{"fixed":"3.4.1","introduced":"3.4.0"},{"fixed":"4.0.3","introduced":"4.0.0"},{"fixed":"4.1.0","introduced":"4.0.4"}],"component":"@backstage/plugin-scaffolder-backend","cve_ids":["CVE-2026-106501"],"ecosystem":"npm","epss":0.00484,"exploited":false,"fixed_versions":["3.3.1","3.4.1","4.0.3","4.1.0"],"ghsa_id":"GHSA-g2v8-7jhw-pp8p","id":"tcs_01M5KFPRY9ZXRMJX6H77CQWA8M","modified_at":"2026-10-07T18:15:10.728715918Z","published_at":"2026-10-07T17:59:19Z","references":["https://osv.dev/vulnerability/GHSA-g2v8-7jhw-pp8p","https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p","https://nvd.nist.gov/vuln/detail/CVE-2026-106501","https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5","https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5","https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.49.6","https://github.com/backstage/backstage/releases/tag/v1.50.5","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-g2v8-7jhw-pp8p","url":"https://osv.dev/vulnerability/GHSA-g2v8-7jhw-pp8p"}],"summary":"Backstage: Sensitive information exposure in Scaffolder"}