Skip to content
OpenAdvisories

Package · npm

@backstage/backend-defaults

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.0
    CVE-2026-106493

    Backstage: Cloud storage catalog locations may cross configured storage boundaries

    Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog sourc…

    backstage backstage plugin-catalog-backend-module-aws plugin-catalog-backend-module-azure npm
  • Low 3.5
    CVE-2026-24048

    Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

    Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the `FetchUrlReader` comp…

    backstage backstage @backstage/backend-defaults npm