@backstage/backend-defaults

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.1

CVE-2026-24046 Public exploit

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could explo…

backstage backstage @backstage/plugin-scaffolder-backend @backstage/backend-defaults npm

Jan 21, 2026