{"action":"Upgrade @backstage/backend-app-api to 0.5.9-next.1 or later.","affected":[{"fixed":"0.5.9-next.1","introduced":"0"}],"component":"@backstage/backend-app-api","cve_ids":["CVE-2023-6944"],"ecosystem":"npm","epss":0.00561,"exploited":false,"fixed_versions":["0.5.9-next.1"],"ghsa_id":"GHSA-86rg-pf4c-5grg","id":"tcs_01M5KFC0S2897YAW8S3E9X01MR","modified_at":"2025-10-01T20:11:27Z","published_at":"2024-01-04T12:30:20Z","references":["https://osv.dev/vulnerability/GHSA-86rg-pf4c-5grg","https://nvd.nist.gov/vuln/detail/CVE-2023-6944","https://github.com/backstage/backstage/issues/21503","https://github.com/backstage/backstage/pull/21582","https://github.com/backstage/backstage/commit/0382db60f6c8e8715a702bde6408ad10a48d8e11","https://access.redhat.com/errata/RHBA-2024:5869","https://access.redhat.com/security/cve/CVE-2023-6944","https://bugzilla.redhat.com/show_bug.cgi?id=2255204","https://github.com/backstage/backstage","https://github.com/backstage/backstage/blob/master/docs/releases/v1.21.0-next.2-changelog.md","https://www.cve.org/CVERecord?id=CVE-2023-6944"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-86rg-pf4c-5grg","url":"https://osv.dev/vulnerability/GHSA-86rg-pf4c-5grg"}],"summary":"@backstage/backend-app-api leaks GitLab access tokens"}