| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | < 1.54.6 | 1.54.6 |
| backstage/backend defaults | < 0.17.8 | 0.17.8 |
| @backstage/backend-defaults | < 0.17.8 | 0.17.8 |
An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.
Patched in @backstage/backend-defaults version 0.17.8
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free