CVE-2024-45815 Prototype pollution in @backstage/plugin-catalog-backend

What is CVE-2024-45815?

CVE-2024-45815 is a medium-severity vulnerability in Linuxfoundation Backstage, published on 17 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-1321

Which versions are affected by CVE-2024-45815?

2 open source packages ship an affected version, including @backstage/plugin-catalog-backend. It affects 1 product.

Products include Linuxfoundation Backstage.

How do I fix CVE-2024-45815?

Upgrade @backstage/plugin-catalog-backend to 1.26.0 or later.

Is CVE-2024-45815 being exploited?

There is no known exploitation of CVE-2024-45815 in the wild and no public exploit code.

Other vulnerabilities in Linuxfoundation Backstage

• CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder Critical 9.6
• CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration High 8.8
• CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration High 8.8
• CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions High 8.5
• CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions High 8.5

All Linuxfoundation Backstage vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3x3f-jcp3-g22j.