labext-pkg (2.1.1), mkdocs-techdocs-core (>=0.2.3, <=1.0.1) potentially affected by CVE-2025-68142 via pymdown-extensions (9.0.0)

pymdown-extensions PYPI version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - labext-pkg 2.1.1 - mkdocs-techdocs-core =0.2.3, =1.0.1 Source cves: CVE-2025-68142 Source advisory: OSV:GHSA-R6H4-MM7H-8PMQ...

mkdocs-material (8.2.11), mkdocs-techdocs-bandicoot (>=1.1.7, <=1.1.9) +1 more potentially affected by CVE-2025-68142 via pymdown-extensions (9.3.0)

pymdown-extensions PYPI version 9.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-material 8.2.11 - mkdocs-techdocs-bandicoot =1.1.7, =1.0.2, =1.1.7 Source cves: CVE-2025-68142 Source advisory:...

mkdocs-techdocs-core (1.2.0) potentially affected by CVE-2025-68142 via pymdown-extensions (9.9.1)

pymdown-extensions PYPI version 9.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core 1.2.0 Source cves: CVE-2025-68142 Source advisory: OSV:GHSA-R6H4-MM7H-8PMQ...

EUVD-2021-1324

Malware in sbrugna...

EUVD-2021-1371

Malware in sbrugna...

EUVD-2021-1373

Malware in sbrugna...

EUVD-2024-2702

Malicious code in bioql PyPI...

EUVD-2024-2722

Malicious code in bioql PyPI...

CVE-2021-32661

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin @backstage/plugin-techdocs prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This...

CVE-2021-32660

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

CVE-2021-32662

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is buil...

TechDocs Module XSS

The vulnerability of the TechDocs module of the Backstage developer portal platform relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Cross-site Scripting (XSS)

@backstage/plugin-techdocs-backend is vulnerable to Cross-Site Scripting XSS. The vulnerability is caused due to improper handling of content in TechDocs storage buckets, allowing an attacker to inject executable scripts that are executed in the victim's browser when viewing documentation or...

CVE-2024-46976

A flaw was found in the backstage/plugin-techdocs-backend package. An attacker with control of the contents of the TechDocs storage buckets may be able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to a...

@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

Impact An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. Patches This has been fixed in the...

GHSA-5J94-F3MF-8685 @backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

Impact An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. Patches This has been fixed in the...

CVE-2024-46976

Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attack...

CVE-2024-45816 Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

CVE-2024-45816 Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...

CVE-2024-45816

Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks...