CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdownextensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.14.6 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to register catalog entities can exploit it by supplying a crafted TechDocs mkdocs.yml. Exploitation occurs when TechDocs builds the associated documentation.
Which systems are exposed to command execution?
The TechDocs build host is the system on which arbitrary OS commands execute. Exposure therefore depends on allowing users who can register catalog entities to provide documentation configurations that are subsequently built by TechDocs.
Which versions contain the fix?
The issue is fixed in @backstage/plugin-techdocs-node versions 1.14.6 and 1.15.4. Versions prior to 1.14.6 are identified as affected.