Vulnerability	Vulnerable Version
H Information Exposure Through an Error Message @backstage/backend-app-api is a Core API used by Backstage backend apps Affected versions of this package are vulnerable to Information Exposure Through an Error Message via the `catalog-import` function when the base64 encoded GitLab token includes a newline at the end of the string. An attacker can gain access to GitLab tokens and potentially push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately by exploiting the leakage of GitLab access tokens on the frontend. How to fix Information Exposure Through an Error Message? Upgrade `@backstage/backend-app-api` to version 0.5.9-next.1 or higher.	<0.5.9-next.1

Information Exposure Through an Error Message

@backstage/backend-app-api is a Core API used by Backstage backend apps

Affected versions of this package are vulnerable to Information Exposure Through an Error Message via the catalog-import function when the base64 encoded GitLab token includes a newline at the end of the string. An attacker can gain access to GitLab tokens and potentially push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately by exploiting the leakage of GitLab access tokens on the frontend.

How to fix Information Exposure Through an Error Message?

Upgrade @backstage/backend-app-api to version 0.5.9-next.1 or higher.

<0.5.9-next.1

Go back to all versions of this package