Backstage: Improper input validation in Sentry scaffolder actions

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-106459 · Microsoft / collected KEV context

EUVD-2026-93993

GHSA-g734-fhp4-7mfp

cve-program · CVE-2026-106459

• https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp
• https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7
• https://github.com/backstage/backstage/releases/tag/v1.54.8
• https://github.com/backstage/backstage/releases/tag/v1.55.0

euvd · EUVD-2026-93993

• https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp
• https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7
• https://github.com/backstage/backstage/releases/tag/v1.54.8
• https://github.com/backstage/backstage/releases/tag/v1.55.0

nvd · CVE-2026-106459

• https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7
• https://github.com/backstage/backstage/releases/tag/v1.54.8
• https://github.com/backstage/backstage/releases/tag/v1.55.0
• https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp

osv · GHSA-g734-fhp4-7mfp

• https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp
• https://nvd.nist.gov/vuln/detail/CVE-2026-106459
• https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.8
• https://github.com/backstage/backstage/releases/tag/v1.55.0

No related operational record is retained in the current change model.