CVE-2023-25571

Medium

Advisory

Published 14 Feb 2023In the index since 9 Sept 2026

Cross site scripting Vulnerability in backstage Software Catalog

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
@backstage/catalog-modelnpm	0.1.1-alpha.23, 0.9.0	1.2.0	2
@backstage/plugin-catalog-backendnpm	0.1.1-alpha.23, 0.13.1	1.7.2	2
@backstage/core-componentsnpm	0.3.0	0.12.4	1

3 by stars

Chart

Latest

Affected images

Radar Score

backstagedeliveryhero

1 of the 2 container images this version deploys carry CVE-2023-25571.

Container image	Digest	Package	Fixed in
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	@backstage/catalog-model@0.1.1-alpha.23 @backstage/plugin-catalog-backend@0.1.1-alpha.23	1.2.0 1.7.2

8,213

backstagehelm-charts-nr

1 of the 2 container images this version deploys carry CVE-2023-25571.

Container image	Digest	Package	Fixed in
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	@backstage/catalog-model@0.1.1-alpha.23 @backstage/plugin-catalog-backend@0.1.1-alpha.23	1.2.0 1.7.2

8,213

backstageirembo-backstage-helm

1 of the 3 container images this version deploys carry CVE-2023-25571.

Container image	Digest	Package	Fixed in
roadiehq/community-backstage-image :latest	ef355bf5b639	@backstage/catalog-model@0.9.0 @backstage/core-components@0.3.0 @backstage/plugin-catalog-backend@0.13.1	1.2.0 0.12.4 1.7.2

7,232

2 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	@backstage/catalog-model@0.1.1-alpha.23 @backstage/plugin-catalog-backend@0.1.1-alpha.23	1.2.0 1.7.2	2
roadiehq/community-backstage-image :latest	ef355bf5b639	@backstage/catalog-model@0.9.0 @backstage/core-components@0.3.0 @backstage/plugin-catalog-backend@0.13.1	1.2.0 0.12.4 1.7.2	1