CVE-2026-106494: @backstage/backend-defaults Improper Input Validation in Cloud Storage URL Readers
Summary
CVE-2026-106494: Backstage: Improper input validation in cloud storage URL readers. Affects @backstage/backend-defaults versions < 0.17.8. Fixed in 0.17.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/backend-defaults package is a core component of the Backstage framework, which is designed to streamline the development and management of software projects. It provides essential backend functionalities, including integrations with cloud storage services. This package is widely used in environments where cloud storage is leveraged for storing and retrieving application data. However, it is susceptible to vulnerabilities that can arise from improper input validation, particularly in how it handles object names in cloud storage.
Vulnerability Detail
The vulnerability arises from improper input validation in the cloud storage URL readers of the @backstage/backend-defaults package. An attacker with write access to a cloud storage bucket can craft object names that collide with protected files in the output directory. This collision can lead to content injection, potentially compromising the integrity of the application. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (External Control of File Name or Path).
How To Fix
Latest published version: 0.18.1 as of 22 Oct 2026
npm install @backstage/backend-defaults@0.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.8
This is the first release that contains the fix.
npm install @backstage/backend-defaults@0.17.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict write access to the cloud storage bucket to prevent unauthorized users from crafting malicious object names. Additionally, implement strict validation checks on object names before processing them in your application.
Conclusion
The CVE-2026-106494 vulnerability in the @backstage/backend-defaults package poses a significant risk due to improper input validation in cloud storage URL readers. It is crucial for users of this package to update to the patched version 0.17.8 to safeguard their applications from potential content injection attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for @backstage/backend-defaults →
FAQ
CVE-2026-106494 is a vulnerability in the @backstage/backend-defaults package that allows attackers to perform content injection through improper input validation in cloud storage URL readers.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
If exploited, this vulnerability can lead to content injection, which may compromise the integrity of your application and allow attackers to manipulate or corrupt data.
Yes, a patch is available in version 0.17.8 of the @backstage/backend-defaults package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement access restrictions on your cloud storage bucket and validate object names rigorously to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/backend-defaults.
