{"action":"Upgrade @backstage/core-components to 0.12.4 or later.","affected":[{"fixed":"0.12.4","introduced":"0"}],"component":"@backstage/core-components","cve_ids":["CVE-2023-25571"],"ecosystem":"npm","epss":0.00453,"exploited":false,"fixed_versions":["0.12.4"],"ghsa_id":"GHSA-7hv8-3fr9-j2hv","id":"tcs_01M5KFA5ZMM3MMG3MYT6FMSKNY","modified_at":"2026-09-10T03:49:56.731928688Z","published_at":"2023-02-14T21:35:10Z","references":["https://osv.dev/vulnerability/GHSA-7hv8-3fr9-j2hv","https://github.com/backstage/backstage/security/advisories/GHSA-7hv8-3fr9-j2hv","https://nvd.nist.gov/vuln/detail/CVE-2023-25571","https://github.com/backstage/backstage/commit/3d1371954512f7fa8bd0e2d357e00eada2c3e8a8","https://github.com/backstage/backstage"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-7hv8-3fr9-j2hv","url":"https://osv.dev/vulnerability/GHSA-7hv8-3fr9-j2hv"}],"summary":"Cross site scripting Vulnerability in backstage Software Catalog"}