CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Impact
An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built.
Patches
Patched in @backstage/plugin-techdocs-node, version 1.15.4.
Workarounds
If you cannot upgrade immediately:
- Switch to techdocs.builder: external to isolate TechDocs builds in a container. - Restrict who can register catalog entities with TechDocs annotations. - Audit existing catalog entities for suspicious markdownextensions values in their mkdocs.yml files.
Other sources
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.14.6 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4 - Configuration
Set techdocs.builder to external to isolate TechDocs builds in a container
Backstage TechDocs techdocs.builder = external - Compensating control
Audit existing catalog entities for suspicious markdown_extensions values in their mkdocs.yml files
- Compensating control
Restrict who can register catalog entities with TechDocs annotations
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to register catalog entities can exploit it by supplying a crafted TechDocs mkdocs.yml. Exploitation occurs when TechDocs builds the associated documentation.
Which systems are exposed to command execution?
The TechDocs build host is the system on which arbitrary OS commands execute. Exposure therefore depends on allowing users who can register catalog entities to provide documentation configurations that are subsequently built by TechDocs.
Which versions contain the fix?
The issue is fixed in @backstage/plugin-techdocs-node versions 1.14.6 and 1.15.4. Versions prior to 1.14.6 are identified as affected.