CVE-2026-106557 · GHSA-f7v3-xhm6-w245

Backstage has improper input validation in TechDocs Markdown extension configuration

Risk score: 56/100
CVSS: 7.7 v3.1
Exploit chance (30 days): 0.3%
Published: 7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access res…
Affected: @backstage/plugin-techdocs-node (npm) < 1.15.4
Fix: Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.7 high
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@backstage/plugin-techdocs-node	npm	< 1.15.4	1.15.4

References

Original description

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.

Last activity 7 Oct 2026. Patch Forecast updates every hour.