{"action":"Upgrade @backstage/backend-defaults to 0.12.2 or later.","affected":[{"fixed":"0.12.2","introduced":"0"},{"fixed":"0.13.2","introduced":"0.13.0"},{"fixed":"0.14.1","introduced":"0.14.0"}],"component":"@backstage/backend-defaults","cve_ids":["CVE-2026-24046"],"ecosystem":"npm","epss":0.00525,"exploited":false,"fixed_versions":["0.12.2","0.13.2","0.14.1"],"ghsa_id":"GHSA-rq6q-wr2q-7pgp","id":"tcs_01M5KG9KM213DFW5GNRXYEY92V","modified_at":"2026-02-03T03:12:21.539851Z","published_at":"2026-01-21T22:36:36Z","references":["https://osv.dev/vulnerability/GHSA-rq6q-wr2q-7pgp","https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp","https://nvd.nist.gov/vuln/detail/CVE-2026-24046","https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d","https://github.com/backstage/backstage"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-rq6q-wr2q-7pgp","url":"https://osv.dev/vulnerability/GHSA-rq6q-wr2q-7pgp"}],"summary":"Backstage has a Possible Symlink Path Traversal in Scaffolder Actions"}