GitHub Advisoryadvisory · npm

GHSA-4488-j8vj-vqqv Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106510
Ecosystem
npm
Packages
@backstage/plugin-techdocs-node
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-183, CWE-470
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-techdocs-node: < 1.15.4 → fixed in 1.15.4

Description

Impact An authenticated user who can register catalog entities can provide a crafted `mkdocs.yml` causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in `@backstage/plugin-techdocs-node`, version `1.15.4`. Workarounds If you cannot upgrade immediately: • Switch to `techdocs.builder: external` to isolate TechDocs builds in a container. • Restrict who can register catalog entities with TechDocs annotations. • Audit existing catalog entities for suspicious `markdown_extensions` values in their `mkdocs.yml` files.

Related

Alias · CVE (1)

  • CVE-2026-106510 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (2)

  • CWE-183 Permissive List of Allowed Inputs weakness
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References