CVE-2026-29185: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29185 is a path traversal vulnerability in the @backstage/integration npm package that allows attackers with high privileges to redirect SCM API requests to unintended endpoints using server-side integration credentials. The flaw exists in SCM URL parsing, where encoded path traversal sequences (e.g., %2F..%2F) are not properly sanitized before being used to construct API URLs. It affects all versions of @backstage/integration up to and including 1.20.0, impacting instances using GitHub, Bitbucket Server, or Bitbucket Cloud integrations with the scaffolder or similar features. Published on March 4, 2026, it carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory, Backstage Advisory).

The root cause is improper neutralization of path traversal sequences in SCM URLs accepted from user input, classified as CWE-22 (Path Traversal). When integration functions parse user-supplied SCM URLs to construct backend API requests, encoded traversal segments (e.g., %2F..%2F or similar URL-encoded sequences) bypass validation and are included in the resulting API URL path. This can cause the Backstage server to issue authenticated API requests — using its configured server-side SCM integration tokens — to unintended API endpoints on the SCM provider. Exploitation requires the attacker to have high privileges (e.g., the ability to submit SCM URLs through the scaffolder or similar Backstage features) and is performed over the network without user interaction (GitHub Advisory, Backstage Advisory).

Successful exploitation results in a limited confidentiality impact: an authenticated attacker can cause the Backstage server to make API requests to unintended SCM provider endpoints (GitHub, Bitbucket Server, or Bitbucket Cloud) using the server's built-in integration credentials, potentially reading data from SCM API endpoints that the attacker would not otherwise have direct access to. There is no integrity or availability impact. The scope is unchanged, meaning the impact is confined to the SCM provider's API surface accessible via the configured integration token (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-29185. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability requires high privileges to exploit, significantly limiting the attacker pool. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain privileged access: Obtain a Backstage account with sufficient privileges to submit SCM URLs through the scaffolder or another feature that accepts user-provided SCM URLs.
2. Craft a malicious SCM URL: Construct a URL containing URL-encoded path traversal sequences (e.g., https://github.com/org/repo%2F..%2F..%2Ftarget-endpoint) targeting an unintended SCM API endpoint.
3. Submit the URL: Provide the crafted URL as input to the Backstage scaffolder or equivalent feature that processes SCM URLs via the @backstage/integration package.
4. Trigger server-side API request: The Backstage backend parses the URL, fails to sanitize the encoded traversal segments, and constructs an API request to the unintended SCM endpoint using the server's configured integration credentials.
5. Read response data: The server relays the API response, potentially exposing data from SCM API endpoints accessible via the integration token that the attacker could not directly access (GitHub Advisory, Backstage Advisory).

• Logs: Backstage server logs showing outbound API requests to unexpected or unusual SCM API endpoint paths (e.g., paths containing .. or traversal-like segments after URL decoding); requests to SCM provider APIs for resources not associated with any known scaffolder template or catalog entry.
• Network: Outbound HTTP requests from the Backstage server to SCM provider APIs (GitHub API, Bitbucket API) with anomalous URL paths that deviate from expected patterns (e.g., /repos/org/repo/../../other-resource).
• Application Behavior: Scaffolder task logs referencing SCM URLs with encoded characters (%2F, %2E) in the path component beyond the repository identifier.

The vulnerability is patched in @backstage/integration version 1.20.1. Users should upgrade to this version immediately. The Backstage maintainers have confirmed there is no workaround available — upgrading to the patched version is the only remediation. Organizations can also review and restrict which users have access to features that accept user-provided SCM URLs (e.g., the scaffolder) as a defense-in-depth measure (GitHub Advisory, Backstage Advisory).

The advisory was published by benjdlambert on behalf of the Backstage project on March 4, 2026, and reviewed by the GitHub Advisory Database on March 5, 2026. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified for this low-severity vulnerability (GitHub Advisory).