Backstage vulnerable to potential reading of SCM URLs using built in token
- Severity:
- Low
Description
A vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths.
Recommendation
Update the @backstage/integration package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.20.0
- Patched version(s): 1.20.1
References
Related Issues
- Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker - CVE-2026-42553
- Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS - CVE-2026-40171
- Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
- @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes - CVE-2026-31861
You might also like:
- Tags:
- npm
- @backstage/integration
Anything's wrong? Let us know Last updated on March 09, 2026