CVE-2021-32661 json
TechDocs object element script injection
published 2021-06-03 5 y ago modified 2026-07-08 4 mo ago also GHSA-gg96-f8wr-p89f , EUVD-2021-1324
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.
Patch / fix
- npm @backstage/plugin-techdocs 0.9.5
- linuxfoundation @backstage/plugin-techdocs 0.9.5
Exploit prediction
1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 4.9 | AV:N/AC:M/Au:S/C:P/I:P/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @backstage/plugin-techdocs | <0.9.5 |
0.9.5 |
Affected products
- backstage backstage
Classification
References
-
github.com
/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c
web, patch, third-party-advisory
-
github.com
/backstage/backstage/releases/tag/release-2021-06-03
web, third-party-advisory
-
github.com
/backstage/backstage/security/advisories/GHSA-gg96-f8wr-p89f
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-32661
advisory
Sources
- CVE List CVE-2021-32661
- GitHub Advisory GHSA-gg96-f8wr-p89f
- NVD CVE-2021-32661
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.