CVE-2026-106505 · GHSA-p75x-jh7p-ppcx
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
- Risk score
- 61/100
- CVSS
- 8.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs confi…
- Affected
- @backstage/plugin-techdocs-node (npm) < 1.15.4
- Fix
- Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.
- Exploitation
- No known exploitation
Story map
At a glance
@backstage/plugin-techdocs-node: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registere…
The flaws
- CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 8.5 · EPSS 0%)
- CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 8.8 · EPSS 0%)
- CVE-2026-106558: Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8 · EPSS 0%)
- CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml (CVSS 7.7 · EPSS 0%)
The fix
Upgrade @backstage/plugin-techdocs-node: 1.14.6 · 1.15.4 · 1.14.8 · 1.15.6 · 2.0.1 or later on your release line
Who is exposed: @backstage/plugin-techdocs-node (npm) < 1.15.4
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-426 (CWE-426). 17 other warnings in 30 days
- Same product: Earlier @backstage/plugin-techdocs-node warnings. 3 in the last 90 days
Why it is Amber
- CVSS 8.5 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-techdocs-node | npm | < 1.15.4 | 1.15.4 |
References
- https://github.com/advisories/GHSA-p75x-jh7p-ppcx
- https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx
- https://nvd.nist.gov/vuln/detail/CVE-2026-106505
- https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9
- https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-p75x-jh7p-ppcx
Original description
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
Last activity 6 Oct 2026. Patch Forecast updates every hour.