~ / search / GHSA-75qf-886x-5xf2

GHSA-75qf-886x-5xf2

Backstage: Improper input validation in Confluence to Markdown scaffolder module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-106559

Packages

EcosystemPackageAffectedFixed in
npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown < 0.3.25 0.3.25

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content. ### Patches Patched in `@backstage/plugin-scaffolder-backend-module-confluence-to-markdown` version `0.3.25` ### Workarounds If unable to update immediately: - Restrict Confluence edit access to trusted users. - Review Confluence page content before running scaffolder templates against untrusted pages.

References

External links from the advisory. They lead to third-party sites.