All vulnerabilities
CVE-2026-106510GHSA-4488-j8vj-vqqv

@backstage/plugin-techdocs-node: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

backstage @backstage/plugin-techdocs-nodenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.15.4Fixed versionGitHub
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 1.15.4@backstage/plugin-techdocs-node, npmGitHubnpm install @backstage/plugin-techdocs-node@1.15.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built.

Patches

Patched in @backstage/plugin-techdocs-node, version 1.15.4.

Workarounds

If you cannot upgrade immediately:

  • Switch to techdocs.builder: external to isolate TechDocs builds in a container.
  • Restrict who can register catalog entities with TechDocs annotations.
  • Audit existing catalog entities for suspicious markdown_extensions values in their mkdocs.yml files.

Text from GitHub Advisory Database

Affected versions 6

  • @backstage/plugin-techdocs-node, npm< 1.15.4GitHub
  • backstageaffected: < 1.50.5CVE List
  • backstageaffected: >= 1.51.0-next.0, < 1.54.6CVE List
  • plugin-techdocs-nodeaffected: < 1.14.6CVE List
  • plugin-techdocs-nodeaffected: >= 1.15.0, < 1.15.4CVE List
  • @backstage/plugin-techdocs-node, npmfrom first release, fixed in 1.15.4OSV

References 7