GHSA-gg96-f8wr-p89f

    Dashboard / Vulnerabilities / GHSA-gg96-f8wr-p89f

    GHSA-gg96-f8wr-p89f

    Published: 4 Jun 2021Last Modified: 8 Jul 2026

    Summary: Script injection

    Details: ### Impact A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. ### Patches The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`. ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Backstage repository](https://github.com/backstage/backstage) * Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)

    References: https://github.com/backstage/backstage/security/advisories/GHSA-gg96-f8wr-p89f, https://nvd.nist.gov/vuln/detail/CVE-2021-32661, https://github.com/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c, https://github.com/backstage/backstage/releases/tag/release-2021-06-03

    Affected packages

    Package

    Name: @backstage/plugin-techdocs

    Purl: pkg:npm/%40backstage/plugin-techdocs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.9.5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gg96-f8wr-p89f | CVE-DB