Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. This issue is fixed in version 0.17.8.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c Patch
- https://github.com/backstage/backstage/releases/tag/v1.54.6 Patch, Release Notes
- https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3 Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.9 · linuxfoundationNVD modified 2026-10-22 13:03
Affected (CPE criteria) 2
cpe:2.3:a:linuxfoundation:backstage\/backend_defaults:*:*:*:*:*:node.js:*:*cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*