Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@backstage/plugin-catalog-backend

5 known vulnerabilities (1 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 high, 3 medium, 1 low
Weekly downloads
218.7K
Dependents
20
Registry
npm

Advisories 5

  • CVE-2026-115923Medium 6.5

    Backstage catalog rules can be bypassed for URL locations using encoded path segments

    Affected: fixed in 3.9.2; from 4.0.0, fixed in 4.0.2.

  • Backstage: Improper URL validation in catalog entity placeholder resolution

    Affected: fixed in 3.9.1.

  • Backstage: Inconsistent enforcement of allowed location types during catalog processing

    Affected: fixed in 3.9.1.

  • CVE-2024-45815Medium 6.5

    Prototype pollution in @backstage/plugin-catalog-backend

    Affected: fixed in 1.26.0.

  • CVE-2023-25571Medium 6.8

    Backstage has XSS Vulnerability in Software Catalog

    Affected: fixed in 1.7.2.