{"action":"Upgrade @backstage/plugin-scaffolder-backend to 2.2.2 or later.","affected":[{"fixed":"2.2.2","introduced":"0"},{"fixed":"3.0.2","introduced":"3.0.0"},{"fixed":"3.1.1","introduced":"3.1.0"}],"component":"@backstage/plugin-scaffolder-backend","cve_ids":["CVE-2026-24046"],"ecosystem":"npm","epss":0.00525,"exploited":false,"fixed_versions":["2.2.2","3.0.2","3.1.1"],"ghsa_id":"GHSA-rq6q-wr2q-7pgp","id":"tcs_01M5KG9KTWY17B0WS74CR409NB","modified_at":"2026-02-03T03:12:21.539851Z","published_at":"2026-01-21T22:36:36Z","references":["https://osv.dev/vulnerability/GHSA-rq6q-wr2q-7pgp","https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp","https://nvd.nist.gov/vuln/detail/CVE-2026-24046","https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d","https://github.com/backstage/backstage"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-rq6q-wr2q-7pgp#npm/@backstage/plugin-scaffolder-backend","url":"https://osv.dev/vulnerability/GHSA-rq6q-wr2q-7pgp"}],"summary":"Backstage has a Possible Symlink Path Traversal in Scaffolder Actions"}