Backstage catalog rules can be bypassed for URL locations using encoded path segments

影響: npm:@backstage/plugin-catalog-backend < 3.9.2 → 3.9.2, npm:@backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → 4.0.2

@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules locati…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 07:42, GitHub Advisory Database에서 "Backstage catalog rules can be bypassed for URL locations using encoded path segments"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-115923.