Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@backstage/core-components

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.8npmAmendedPublished

    Cross site scripting Vulnerability in backstage Software Catalog

    CVE-2023-25571 · GHSA-7hv8-3fr9-j2hv

    Affected
    • npm @backstage/core-components < 0.12.4
    Fixed in
    0.12.4· Vendor fix available
    Issue
    Impact This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack. Patches This vulnerability has been patched in both the frontend and backend implementations. The default Link component from @backstage/core-components will now reject javascript: URLs, and there is a global override of window.open to do the same. In addition the catalog model as well as the catalog backend now has additional validation built in that prevents javascript: URLs in known annotations. Workarounds The general practice of limiting access to modifying catalog content and requiring code reviews greatly helps mitigate this vulnerability. For more information If you have any questions or comments about this advisory: Open an issue in the Backstage repository Visit our chat, linked to in the Backstage…

    Recommended action: Upgrade to 0.12.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →