https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 12:29:32 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-92464 cnvd-2021-92464 https://cve.radiocsirt.org/vuln/cnvd-2021-92464 https://cve.radiocsirt.org/vuln/euvd-2026-32636 EUVD-2026-32636 https://cve.radiocsirt.org/vuln/euvd-2026-32636 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43776 <p>Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user&#39;s browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.</p> <p>Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user&#39;s browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-43776 https://cve.radiocsirt.org/vuln/ghsa-w7fj-336r-vw49 <p><strong>Affected:</strong> npm: @backstage/plugin-auth-backend</p> <p>### Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user&#39;s browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities.</p> <p>### Patches This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>* Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)</p> <p><strong>Affected:</strong> npm: @backstage/plugin-auth-backend</p> <p>### Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user&#39;s browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities.</p> <p>### Patches This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>* Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)</p> https://cve.radiocsirt.org/vuln/ghsa-w7fj-336r-vw49 https://cve.radiocsirt.org/vuln/gsd-2021-43776 gsd-2021-43776 https://cve.radiocsirt.org/vuln/gsd-2021-43776