Description
A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive data when other users visit that same documentation page.
Recommendation
Update the @backstage/plugin-techdocs package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.9.5
- Patched version(s): 0.9.5
References
Could your website be exposed too?
SmartScanner can check your website for Script injection - @backstage/plugin-techdocs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Script injection - CVE-2021-32660
- Command injection in launchpad - CVE-2021-23330
- TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
- Unsanitized JavaScript code injection possible in gatsby-plugin-mdx - CVE-2022-25863
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023