CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.14.6 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments using @backstage/plugin-techdocs-node with TechDocs configured to build documentation locally or in a container are exposed if users have write access to a registered repository. Those users can supply malicious values through that repository's mkdocs.yml file.
What access does an attacker need?
The attacker needs write access to a repository registered with TechDocs. No user interaction is required once the malicious documentation configuration is processed during a build.
Are all TechDocs deployments affected?
The issue is described only for TechDocs deployments that build documentation locally or in a container. The provided information does not identify other build configurations as affected.
Which versions contain the fix?
The issue is fixed in @backstage/plugin-techdocs-node versions 1.14.6 and 1.15.4. Versions prior to 1.14.6 are identified as affected.