CVE-2026-88064: Backstage: Improper input validation in TechDocs MkDocs configuration
Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdownextensions names and configuration, theme options, and extratemplates values can reach the documentation generator and cause unintended code execution. The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.14.6 - Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.15.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can register or modify a TechDocs source can supply a malicious mkdocs.yml. Exploitation does not require user interaction and can be performed over the network.
What resources could an attacker access after successful exploitation?
Code execution is limited to the files, credentials, network access, and other resources available to the TechDocs backend or its build container. The practical impact therefore depends on how that backend or container is permissioned and isolated.
Which configurations in mkdocs.yml are relevant to exploitation?
Unsafe Python YAML tags, markdown_extensions names and their configuration, theme options, and extra_templates values can reach the documentation generator. Review TechDocs sources that allow users to control these fields.
How can I remediate affected installations?
Upgrade @backstage/plugin-techdocs-node to version 1.14.6 or 1.15.4, as applicable. The affected ranges are versions before 1.14.6 and versions from 1.15.0 through 1.15.3.