| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | ≥ 1.50.0, < 1.50.5≥ 1.51.0, < 1.51.3≥ 1.52.0, < 1.53.2≥ 1.54.0, < 1.54.6< 1.49.6 | 1.50.51.51.31.53.21.54.61.49.6 |
| backstage plugin-catalog-backend | ≥ 3.6.0, < 3.6.2≥ 3.7.0, < 3.7.2≥ 3.8.0, < 3.8.2≥ 3.9.0, < 3.9.1< 3.5.1 | 3.6.23.7.23.8.23.9.13.5.1 |
| @backstage/plugin-catalog-backend | < 3.9.1 | 3.9.1 |
An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user.
Patched in @backstage/plugin-catalog-backend version 3.9.1
If you're not able to update immediately:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free