| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | < 1.26.0 | 1.26.0 |
| @backstage/plugin-catalog-backend | < 1.26.0 | 1.26.0 |
A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API.
This has been fixed in the 1.26.0 release of the @backstage/plugin-catalog-backend package.
If you have any questions or comments about this advisory:
Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free