p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de @backstage/plugin-scaffolder-backend-module-bitbucket-cloud

Vulnérabilités publiées pour @backstage/plugin-scaffolder-backend-module-bitbucket-cloud au cours des 30 derniers jours : 2. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 2

  1. CVE-2026-106486

    Élevée · CVSS 8.5EPSS 0,37%Correctif disponible

    Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

    Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backst

    @backstage/plugin-scaffolder-backend-module-bitbucket-cloudNode.js
    • Mettez à jour vers 0.3.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-106462

    Moyenne · CVSS 6.4EPSS 0,17%Correctif disponible

    Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

    Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

    @backstage/plugin-scaffolder-backend-module-bitbucket-cloudNode.js
    • Mettez à jour vers 0.3.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →