CVE-2026-106559: Backstage: Improper input validation in Confluence to Markdown scaffolder module

October 7, 2026

Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content.

References

github.com/advisories/GHSA-75qf-886x-5xf2
github.com/backstage/backstage/commit/506c2c11bce3ed9d1f8f50de5d6474b16e43a65e
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-75qf-886x-5xf2
nvd.nist.gov/vuln/detail/CVE-2026-106559

Code Behaviors & Features

Detect and mitigate CVE-2026-106559 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →