Backstage: Improper input validation in Confluence to Markdown scaffolder module

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-106559 · Microsoft / collected KEV context

EUVD-2026-94372

GHSA-75qf-886x-5xf2

cve-program · CVE-2026-106559

• https://github.com/backstage/backstage/security/advisories/GHSA-75qf-886x-5xf2
• https://github.com/backstage/backstage/commit/506c2c11bce3ed9d1f8f50de5d6474b16e43a65e
• https://github.com/backstage/backstage/releases/tag/v1.54.6

euvd · EUVD-2026-94372

• https://github.com/backstage/backstage/security/advisories/GHSA-75qf-886x-5xf2
• https://github.com/backstage/backstage/commit/506c2c11bce3ed9d1f8f50de5d6474b16e43a65e
• https://github.com/backstage/backstage/releases/tag/v1.54.6

nvd · CVE-2026-106559

• https://github.com/backstage/backstage/commit/506c2c11bce3ed9d1f8f50de5d6474b16e43a65e
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-75qf-886x-5xf2

osv · GHSA-75qf-886x-5xf2

• https://github.com/backstage/backstage/security/advisories/GHSA-75qf-886x-5xf2
• https://nvd.nist.gov/vuln/detail/CVE-2026-106559
• https://github.com/backstage/backstage/commit/506c2c11bce3ed9d1f8f50de5d6474b16e43a65e
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.6

No related operational record is retained in the current change model.