CVE-2023-6944 – @backstage/backend-app-api

Package

Manager: npm
Name: @backstage/backend-app-api
Vulnerable Version: >=0 <0.5.9-next.1

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00165 pctl0.38019

Details

@backstage/backend-app-api leaks GitLab access tokens A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.

Metadata

Created: 2024-01-04T12:30:20Z
Modified: 2025-09-05T16:12:40Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-86rg-pf4c-5grg/GHSA-86rg-pf4c-5grg.json
CWE IDs: ["CWE-200", "CWE-209"]
Alternative ID: GHSA-86rg-pf4c-5grg
Finding: F310
Auto approve: 1