CVE-2026-106510 · GHSA-4488-j8vj-vqqv
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
- Risk score
- 59/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbit…
- Affected
- @backstage/plugin-techdocs-node (npm) < 1.15.4
- Fix
- Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.
- Exploitation
- No known exploitation
Story map
At a glance
@backstage/plugin-techdocs-node: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registere…
The flaws
- CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml (CVSS 7.7 · EPSS 0%)
- CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs (CVSS 8.8 · EPSS 0%)
- CVE-2026-106558: Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8 · EPSS 0%)
- CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (CVSS 8.5 · EPSS 0%)
The fix
Upgrade @backstage/plugin-techdocs-node: 1.14.6 · 1.15.4 · 1.14.8 · 1.15.6 · 2.0.1 or later on your release line
Who is exposed: @backstage/plugin-techdocs-node (npm) < 1.15.4
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-183 (CWE-183). 2 other warnings in 30 days
- Same product: Earlier @backstage/plugin-techdocs-node warnings. 3 in the last 90 days
Why it is Yellow
- CVSS 7.7 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-techdocs-node | npm | < 1.15.4 | 1.15.4 |
References
- https://github.com/advisories/GHSA-4488-j8vj-vqqv
- https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv
- https://nvd.nist.gov/vuln/detail/CVE-2026-106510
- https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb
- https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-4488-j8vj-vqqv
Original description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
Last activity 7 Oct 2026. Patch Forecast updates every hour.