Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@backstage/backend-app-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3npmAmendedPublished

    @backstage/backend-app-api leaks GitLab access tokens

    CVE-2023-6944 · GHSA-86rg-pf4c-5grg

    Affected
    • npm @backstage/backend-app-api < 0.5.9-next.1
    Fixed in
    0.5.9-next.1· Vendor fix available
    Issue
    A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.

    Recommended action: Upgrade to 0.5.9-next.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →