LOW3.5npm
GHSA-q2x5-4xjx-c6p9· CVE-2026-24048Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
Modified: 2/3/2026
package
npm/@backstage/backend-defaults
pkg:npm/%40backstage/backend-defaults
HIGH7.1npm
GHSA-rq6q-wr2q-7pgp· CVE-2026-24046Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Modified: 2/3/2026