Homepage

@backstage/backend-app-api@0.0.0-nightly-20230225023059 vulnerabilities

Core API used by Backstage backend apps

  • latest version

    1.2.8

  • latest non vulnerable version

    1.2.9-next.0

  • first published

    3 years ago

  • latest version published

    13 days ago

  • View backend-app-api package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @backstage/backend-app-api package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Information Exposure Through an Error Message

    @backstage/backend-app-api is a Core API used by Backstage backend apps

    Affected versions of this package are vulnerable to Information Exposure Through an Error Message via the catalog-import function when the base64 encoded GitLab token includes a newline at the end of the string. An attacker can gain access to GitLab tokens and potentially push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately by exploiting the leakage of GitLab access tokens on the frontend.

    How to fix Information Exposure Through an Error Message?

    Upgrade @backstage/backend-app-api to version 0.5.9-next.1 or higher.

    <0.5.9-next.1
    Go back to all versions of this package