- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 6 · 2 high, 2 medium, 2 low
- Weekly downloads
- 436.1K
- Dependents
- 96
- Registry
- npm
Advisories 6
- CVE-2026-106495Medium 4.3
Backstage: Improper access control in backend action invocation
Affected: fixed in 0.17.8.
- CVE-2026-106494Medium 4.4
Backstage: Improper input validation in cloud storage URL readers
Affected: fixed in 0.17.8.
- CVE-2026-106493Low 3.0
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Affected: fixed in 0.17.8.
- CVE-2026-106492High 7.6
Backstage: Improper preservation of access restrictions during service credential delegation
Affected: fixed in 0.17.8.
- CVE-2026-24048Low 3.5
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
Affected: fixed in 0.12.2; from 0.13.0, fixed in 0.13.2; from 0.14.0, fixed in 0.14.1.
- CVE-2026-24046High 7.1
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Affected: fixed in 0.12.2; from 0.13.0, fixed in 0.13.2; from 0.14.0, fixed in 0.14.1.