{"action":"Upgrade @backstage/plugin-catalog-backend to 3.9.1 or later.","affected":[{"fixed":"3.9.1","introduced":"0"}],"component":"@backstage/plugin-catalog-backend","cve_ids":["CVE-2026-106498"],"ecosystem":"npm","epss":0.00307,"exploited":false,"fixed_versions":["3.9.1"],"ghsa_id":"GHSA-qgvj-qcf8-xq73","id":"tcs_01M5KG64GC25Y2AWD071E8V6SZ","modified_at":"2026-10-07T18:15:10.710570023Z","published_at":"2026-10-07T17:59:24Z","references":["https://osv.dev/vulnerability/GHSA-qgvj-qcf8-xq73","https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73","https://nvd.nist.gov/vuln/detail/CVE-2026-106498","https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e","https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1","https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634","https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197","https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.49.6","https://github.com/backstage/backstage/releases/tag/v1.50.5","https://github.com/backstage/backstage/releases/tag/v1.51.3","https://github.com/backstage/backstage/releases/tag/v1.53.2","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-qgvj-qcf8-xq73","url":"https://osv.dev/vulnerability/GHSA-qgvj-qcf8-xq73"}],"summary":"Backstage: Improper URL validation in catalog entity placeholder resolution"}