CVE-2026-106509 · GHSA-8w7q-29mw-gf5c
Backstage: Improper validation of MkDocs theme configuration in TechDocs
- Risk score
- 69/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registere…
- Affected
- @backstage/plugin-techdocs-node (npm) < 1.15.4
- Fix
- Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
@backstage/plugin-techdocs-node: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registere…
The flaws
- CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 8.8 · EPSS 0%)
- CVE-2026-106558: Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8 · EPSS 0%)
- CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 8.5 · EPSS 0%)
- CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml (CVSS 7.7 · EPSS 0%)
The fix
Upgrade @backstage/plugin-techdocs-node: 1.14.6 · 1.15.4 · 1.14.8 · 1.15.6 · 2.0.1 or later on your release line
Who is exposed: @backstage/plugin-techdocs-node (npm) < 1.15.4
Where it stands
- Public proof of concept
Connects to
- Same weakness: Code injection (CWE-94). 239 other warnings in 30 days
- Same product: Earlier @backstage/plugin-techdocs-node warnings. 3 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- Public exploit or proof of concept referenced
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-techdocs-node | npm | < 1.15.4 | 1.15.4 |
References
- https://github.com/advisories/GHSA-8w7q-29mw-gf5c
- https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c
- https://nvd.nist.gov/vuln/detail/CVE-2026-106509
- https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb
- https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-8w7q-29mw-gf5c
Original description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.
Last activity 6 Oct 2026. Patch Forecast updates every hour.