@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: GHSA-4488-J8VJ-VQQV...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106509 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106509 Source advisory: MEND:CVE-2026-106509...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.12-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.6-next.1) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.3-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.6-next.1 Source cves: CVE-2026-29186 Source advisory: OSV:GHSA-928R-FM4V-MVRW...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by unknown CVE via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.11.15)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-2021102622333, =0.8.16 Source cves: unknown CVE Source advisory: GHSA-4JQC-JVH2-PXG9...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=0.14.1), @backstage/techdocs-common (>=0.11.13, <=0.11.16-next.2) +1 more potentially affected by unknown CVE via @backstage/plugin-techdocs-node (>=1.0.0, <=1.1.2-next.2)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =0.8.16 Source cves: unknown CVE Source advisory: OSV:GHSA-4JQC-JVH2-PXG9...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=0.14.1), @backstage/techdocs-common (>=0.11.13, <=0.11.16-next.2) +1 more potentially affected by unknown CVE via @backstage/plugin-techdocs-node (>=1.0.0, <=1.1.2-next.2)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =0.8.16 Source cves: unknown CVE Source advisory: GHSA-4JQC-JVH2-PXG9...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32660 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32660 Source advisory: GHSA-PWHF-39XG-4RXW...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32662 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32662 Source advisory: GHSA-PGF8-28GG-VPR6...

CVE-2021-32662

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In "@backstage/techdocs-common" versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32662 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32662 Source advisory: MEND:CVE-2021-32662...

CVE-2021-32662 TechDocs mkdocs.yml path traversal

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is buil...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32660 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32660 Source advisory: MEND:CVE-2021-32660...

CVE-2021-32660

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of "@backstage/tehdocs-common" prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

PT-2021-19840

Name of the Vulnerable Software and Affected Versions @backstage/techdocs-common versions prior to 0.6.3 Description A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs dir in mkdocs.yml. These...

CVE-2021-32660: Improper Neutralization of Special Elements used in a Command

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

PT-2021-19838

Name of the Vulnerable Software and Affected Versions @backstage/techdocs-common versions prior to 0.6.4 Description A malicious internal actor can upload documentation content with malicious scripts, which would normally be sanitized by the TechDocs frontend. However, by tricking a user into...

CVE-2021-32662: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is buil...