Backstage catalog rules can be bypassed for URL locations using encoded path segments

影響: npm:@backstage/plugin-catalog-backend < 3.9.2 → 3.9.2, npm:@backstage/plugin-catalog-backend >= 4.0.0, < 4.0.2 → 4.0.2

@backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope. Details When a deployment restricts catalog kinds to trusted URL prefixes using catalog.rules locati…

在 GitHub Advisory Database 阅读

2026/10/29 07:42，GitHub Advisory Database 发布了“Backstage catalog rules can be bypassed for URL locations using encoded path segments”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-115923。