Backstage catalog rules can be bypassed for URL locations using encoded path segments

影響: npm:@backstage/plugin-catalog-backend < 3.9.2 → 3.9.2, npm:@backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → 4.0.2

@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules locati…

GitHub Advisory Databaseで読む

2026/10/29 07:42、GitHub Advisory Databaseが「Backstage catalog rules can be bypassed for URL locations using encoded path segments」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-115923。