Homepage
About Snyk

@backstage/backend-app-api@0.3.1 vulnerabilities

Core API used by Backstage backend apps

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @backstage/backend-app-api package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Information Exposure Through an Error Message

@backstage/backend-app-api is a Core API used by Backstage backend apps

Affected versions of this package are vulnerable to Information Exposure Through an Error Message via the catalog-import function when the base64 encoded GitLab token includes a newline at the end of the string. An attacker can gain access to GitLab tokens and potentially push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately by exploiting the leakage of GitLab access tokens on the frontend.

How to fix Information Exposure Through an Error Message?

Upgrade @backstage/backend-app-api to version 0.5.9-next.1 or higher.

<0.5.9-next.1
Go back to all versions of this package