npm package report

Is @backstage/plugin-techdocs-backend safe?

2 known vulnerabilities, worst severity HIGH.

cvss

6.5

how bad it is if exploited, out of 10

epss

0.70%

chance of exploitation in the next 30 days

xyz score

3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-39v3-f278-vj3g, the advisory selected below

// advisories

GHSA-39v3-f278-vj3g

HIGHCVE-2024-45816

When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage.

Affected: < 1.10.13
Fixed in: 1.10.13
Weakness: CWE-22
Published: 2024-09-17
Source: github

GHSA NVD MITRE reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:39 UTC. The most recent advisory here was published 2024-09-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is @backstage/plugin-techdocs-backend safe? npm package security report | CyberXYZ