1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
backstage-plugin-catalog-backend-module-bitbucket-server
Ecosystem: npm
Downloads: 14.87 K
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting backstage-plugin-catalog-backend-module-bitbucket-server, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-c36c-cf6r-ghgj | Moderate | Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates### Impact Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This can cause catalog entities and metadata to be ingested f |
| GitHub (opens in a new tab) |
- GHSA-c36c-cf6r-ghgjModerateBackstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
>= 0.4.0, < 0.5.15
### Impact Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This can cause catalog entities and metadata to be ingested f
CVE: CVE-2026-106458