{"id":"ghsa-ghsa-w658-mh9p-ww8f","seq":2056909,"kind":"advisory","title":"Backstage catalog rules can be bypassed for URL locations using encoded path segments","url":"https://github.com/advisories/GHSA-w658-mh9p-ww8f","permalink":"https://vulnpulse.app/items/ghsa-ghsa-w658-mh9p-ww8f","summary":"影響: npm:@backstage/plugin-catalog-backend < 3.9.2 → 3.9.2, npm:@backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → 4.0.2\n@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules locati…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-115923"],"tags":["GHSA-w658-mh9p-ww8f","@backstage/plugin-catalog-backend","@backstage/plugin-catalog-backend"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T22:42:36.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}