@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.11-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.5-next.2) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.2-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.5-next.1 Source cves: CVE-2026-29186 Source advisory: GHSA-928R-FM4V-MVRW...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.12-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.6-next.1) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.3-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.6-next.1 Source cves: CVE-2026-29186 Source advisory: OSV:GHSA-928R-FM4V-MVRW...

@backstage/plugin-search-backend-module-techdocs (>=0.4.11-next.0, <=0.4.12-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.6-next.1) +1 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.3-next.1)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.4.11-next.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.6-next.1 Source cves: CVE-2026-29186 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15426449...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25153 Source advisory: OSV:GHSA-6JR7-99PF-8VGF...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25153 Source advisory: GHSA-6JR7-99PF-8VGF...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25153 Source advisory: OSV:GHSA-6JR7-99PF-8VGF...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25152 Source advisory: OSV:GHSA-W669-JJ7H-88M9...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: OSV:GHSA-W669-JJ7H-88M9...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: GHSA-W669-JJ7H-88M9...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25152 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15166605...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15166605...

CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25152 Source advisory: MEND:CVE-2026-25152...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25152 Source advisory: MEND:CVE-2026-25152...

CVE-2026-25152

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

CVE-2026-25153

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with "runIn: local", a malicious actor w...

@backstage/plugin-search-backend-module-techdocs (0.4.11-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.0) +1 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=1.14.0, <=1.14.1-next.0)

@backstage/plugin-techdocs-node NPM version =1.14.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.0 Source cves: CVE-2026-25153 Source advisory: MEND:CVE-2026-25153...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.2) +2 more potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.13.11-next.0)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.10.4-next.2 Source cves: CVE-2026-25153 Source advisory: MEND:CVE-2026-25153...