5vulnerabilities
- Critical0 (0.0%)
- High2 (40.0%)
- Medium0 (0.0%)
- Moderate2 (40.0%)
- Low1 (20.0%)
backstage-plugin-catalog-backend
Ecosystem: npm
Downloads: 728.48 K
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 3 versions
- 1LowAffects 1 version
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 3 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 1
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting backstage-plugin-catalog-backend, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-w658-mh9p-ww8f | Moderate | Backstage catalog rules can be bypassed for URL locations using encoded path segments## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. ## Details When a deployment restricts catalog kinds to trusted URL prefixes using `catalog.rules` location patterns, `DefaultCatalogRulesEnforcer` applies glob matching directly to t |
| GitHub (opens in a new tab) | |
| GHSA-pcmq-25r3-5w9v | Low | Backstage: Inconsistent enforcement of allowed location types during catalog processing### Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds No practical workarounds are available. Upgrade to the patched version. |
| GitHub (opens in a new tab) | |
| GHSA-qgvj-qcf8-xq73 | High | Backstage: Improper URL validation in catalog entity placeholder resolution### Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds If you're not able to update immediately: - Limit the scope of integration credentials (e.g., GitHub tokens) to only the repositories that Backstage needs to access. |
| GitHub (opens in a new tab) | |
| GHSA-3x3f-jcp3-g22j | High | @backstage/plugin-catalog-backend Prototype Pollution vulnerability### Impact A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. ### Patches This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend` package. ### References If you have any questions or comments about this advisory: Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage) |
| GitHub (opens in a new tab) | |
| GHSA-7hv8-3fr9-j2hv | Moderate | Cross site scripting Vulnerability in backstage Software Catalog### Impact This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack. ### Patches This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition the catalog model as well as the catalog |
| GitHub (opens in a new tab) |
- GHSA-w658-mh9p-ww8fModerateBackstage catalog rules can be bypassed for URL locations using encoded path segments
< 3.9.2>= 4.0.0, < 4.0.2
## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. ## Details When a deployment restricts catalog kinds to trusted URL prefixes using `catalog.rules` location patterns, `DefaultCatalogRulesEnforcer` applies glob matching directly to t
CVE: CVE-2026-115923
- GHSA-pcmq-25r3-5w9vLowBackstage: Inconsistent enforcement of allowed location types during catalog processing
< 3.9.1
### Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds No practical workarounds are available. Upgrade to the patched version.
CVE: CVE-2026-106496
- GHSA-qgvj-qcf8-xq73HighBackstage: Improper URL validation in catalog entity placeholder resolution
< 3.9.1
### Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. ### Patches Patched in `@backstage/plugin-catalog-backend` version `3.9.1` ### Workarounds If you're not able to update immediately: - Limit the scope of integration credentials (e.g., GitHub tokens) to only the repositories that Backstage needs to access.
CVE: CVE-2026-106498
- GHSA-3x3f-jcp3-g22jHigh@backstage/plugin-catalog-backend Prototype Pollution vulnerability
< 1.26.0
### Impact A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. ### Patches This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend` package. ### References If you have any questions or comments about this advisory: Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)
CVE: CVE-2024-45815
- GHSA-7hv8-3fr9-j2hvModerateCross site scripting Vulnerability in backstage Software Catalog
< 1.7.2
### Impact This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack. ### Patches This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition the catalog model as well as the catalog
CVE: CVE-2023-25571