Homepage

@backstage/backend-app-api@0.2.4-next.0 vulnerabilities

Core API used by Backstage backend apps

  • latest version

    1.1.0

  • latest non vulnerable version

    1.1.1-next.0

  • first published

    2 years ago

  • latest version published

    8 days ago

  • licenses detected

  • View backend-app-api package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @backstage/backend-app-api package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Information Exposure Through an Error Message

    @backstage/backend-app-api is a Core API used by Backstage backend apps

    Affected versions of this package are vulnerable to Information Exposure Through an Error Message via the catalog-import function when the base64 encoded GitLab token includes a newline at the end of the string. An attacker can gain access to GitLab tokens and potentially push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately by exploiting the leakage of GitLab access tokens on the frontend.

    How to fix Information Exposure Through an Error Message?

    Upgrade @backstage/backend-app-api to version 0.5.9-next.1 or higher.

    <0.5.9-next.1
    Go back to all versions of this package