GHSA-2fc9-xpp8-2g9h
`@backstage/backend-common` vulnerable to path traversal through symlinks
Quick fix
GHSA-2fc9-xpp8-2g9h — @backstage/backend-common: upgrade to the fixed version with the command below.
npm install @backstage/backend-common@0.21.1Details
### Impact
Paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.
### Patches Patched in `@backstage/backend-common` version `0.21.1`. Patched in `@backstage/backend-common` version `0.20.2`. Patched in `@backstage/backend-common` version `0.19.10`.
### For more information If you have any questions or comments about this advisory:
- Open an issue in the [Backstage repository](https://github.com/backstage/backstage) - Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)
Are you affected?
Enter the version of the package you're using.
Affected packages
0.21.0Fixed in: 0.21.1npm install @backstage/backend-common@0.21.10Fixed in: 0.19.10npm install @backstage/backend-common@0.19.100.20.0Fixed in: 0.20.2npm install @backstage/backend-common@0.20.2References
- https://github.com/backstage/backstage/security/advisories/GHSA-2fc9-xpp8-2g9h[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-26150[ADVISORY]
- https://github.com/backstage/backstage/commit/1ad2b1b61ebb430051f7d804b0cc7ebfe7922b6f[WEB]
- https://github.com/backstage/backstage/commit/78f892b3a84d63de2ba167928f171154c447b717[WEB]
- https://github.com/backstage/backstage/commit/edf65d7d31e027599c2415f597d085ee84807871[WEB]
- https://github.com/backstage/backstage[PACKAGE]