REDHAT-BUG-2445480: High severity npm/@backstage/plugin-techdocs-node vulnerability
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-techdocs-nodeto a version that resolves this vulnerability.Fixed in 1.14.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2445480?
The severity of REDHAT-BUG-2445480 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2445480?
To fix REDHAT-BUG-2445480, upgrade to version 1.14.3 or later of the @backstage/plugin-techdocs-node package.
What type of vulnerability is REDHAT-BUG-2445480?
REDHAT-BUG-2445480 is a configuration bypass vulnerability that enables arbitrary code execution.
Which software is affected by REDHAT-BUG-2445480?
The affected software for REDHAT-BUG-2445480 is the @backstage/plugin-techdocs-node package.
What are the implications of exploiting REDHAT-BUG-2445480?
Exploiting REDHAT-BUG-2445480 can lead to arbitrary code execution, posing serious security risks.