Script injection - @backstage/plugin-techdocs

Description

A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive data when other users visit that same documentation page.

Recommendation

Update the @backstage/plugin-techdocs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.9.5
• Patched version(s): 0.9.5

References

• GHSA-gg96-f8wr-p89f
• CVE-2021-32661
• CWE-434
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Script injection - CVE-2021-32660
• Command injection in launchpad - CVE-2021-23330
• TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
• Unsanitized JavaScript code injection possible in gatsby-plugin-mdx - CVE-2022-25863

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@backstage/plugin-techdocs