Skip to content
OpenAdvisories

Package · npm

@backstage/plugin-catalog-backend

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-115923

    Backstage catalog rules can be bypassed for URL locations using encoded path segments

    Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicali…

    backstage backstage @backstage/plugin-catalog-backend npm
  • Medium 6.5
    CVE-2024-45815

    Prototype pollution in @backstage/plugin-catalog-backend

    Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. T…

    backstage backstage @backstage/plugin-catalog-backend npm
  • Medium 6.8
    CVE-2023-25571

    Backstage has XSS Vulnerability in Software Catalog

    Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-site scripting vulner…

    backstage backstage @backstage/plugin-catalog-backend @backstage/catalog-model npm