CVE-2026-106559: Improper Input Validation in @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
Summary
CVE-2026-106559: Backstage: Improper input validation in Confluence to Markdown scaffolder module. Affects @backstage/plugin-scaffolder-backend-module-confluence-to-markdown versions < 0.3.25. Fixed in 0.3.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is a component of the Backstage framework, which is designed to streamline software development processes by enabling users to create and manage templates. This package specifically facilitates the conversion of Confluence content into Markdown format for use in scaffolding applications. However, it has been found to have vulnerabilities that could be exploited if not properly managed.
Vulnerability Detail
The vulnerability arises from insufficient input validation within the Confluence to Markdown scaffolder module. This flaw allows an attacker to manipulate file write operations during the execution of templates. If a Backstage user runs a template that processes content from Confluence that has been influenced by an attacker, it could lead to unauthorized file modifications or other malicious actions. The technical implications include potential data corruption and security breaches, as the attacker can control the content being processed.
How To Fix
Latest published version: 0.3.27 as of 23 Oct 2026
npm install @backstage/plugin-scaffolder-backend-module-confluence-to-markdown@0.3.27Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.25
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend-module-confluence-to-markdown@0.3.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing the following workarounds: 1. Restrict Confluence edit access to trusted users only. 2. Review the content of Confluence pages before executing scaffolder templates against any untrusted pages.
Conclusion
The vulnerability CVE-2026-106559 in the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package poses a moderate risk due to improper input validation. It is crucial to apply the necessary updates or workarounds to mitigate potential threats to your application.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend-module-confluence-to-markdown →
FAQ
CVE-2026-106559 is a vulnerability in the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package that allows for improper input validation, potentially leading to unauthorized file write operations.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized modifications of files and potential data breaches, compromising the integrity and security of your application.
You can update the affected package by running the command: npm install @backstage/plugin-scaffolder-backend-module-confluence-to-markdown@0.3.25 in your terminal.
If you cannot update immediately, restrict edit access in Confluence to trusted users and review content before running scaffolder templates against untrusted pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend-module-confluence-to-markdown.
