CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs
Impact
When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process.
Patches
Patched in @backstage/plugin-techdocs-node version 1.15.4
Workarounds
- Configure TechDocs with techdocs.generator.runIn: 'docker' instead of 'local' to provide container isolation, though this does not fully mitigate the risk. - Restrict write access to repositories registered in the Backstage catalog to trusted users.
Other sources
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.14.6 - Configuration
Configure TechDocs with techdocs.generator.runIn: 'docker' instead of 'local' to provide container isolation; this does not fully mitigate the risk.
Backstage TechDocs techdocs.generator.runIn = docker - Compensating control
Restrict write access to repositories registered in the Backstage catalog to trusted users.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments using @backstage/plugin-techdocs-node with TechDocs configured to build documentation locally or in a container are exposed if users have write access to a registered repository. Those users can supply malicious values through that repository's mkdocs.yml file.
What access does an attacker need?
The attacker needs write access to a repository registered with TechDocs. No user interaction is required once the malicious documentation configuration is processed during a build.
Are all TechDocs deployments affected?
The issue is described only for TechDocs deployments that build documentation locally or in a container. The provided information does not identify other build configurations as affected.
Which versions contain the fix?
The issue is fixed in @backstage/plugin-techdocs-node versions 1.14.6 and 1.15.4. Versions prior to 1.14.6 are identified as affected.