EUVD-2026-94070

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend...

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Impact Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. Patches Patched...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106505 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106505 Source advisory: OSV:GHSA-P75X-JH7P-PPCX...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106505 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106505 Source advisory: GHSA-P75X-JH7P-PPCX...

EUVD-2026-94073

Backstage has potential file exposure through local TechDocs publisher...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106508 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106508 Source advisory: OSV:GHSA-CM77-CH27-6W6V...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106508 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106508 Source advisory: GHSA-CM77-CH27-6W6V...

EUVD-2026-94074

Backstage: Improper validation of MkDocs theme configuration in TechDocs...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106509 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106509 Source advisory: OSV:GHSA-8W7Q-29MW-GF5C...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106509 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106509 Source advisory: GHSA-8W7Q-29MW-GF5C...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106557 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106557 Source advisory: GHSA-F7V3-XHM6-W245...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106557 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106557 Source advisory: OSV:GHSA-F7V3-XHM6-W245...

CVE-2026-106557

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

CVE-2026-106557

The Backstage framework (versions prior to 1.14.6 and 1.15.4 ) is vulnerable to improper input validation within the @backstage/plugin-techdocs-node package. An authenticated user capable of registering or modifying documentation sources can trigger a TechDocs build that accesses resources outsid...

CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106557 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106557 Source advisory: MEND:CVE-2026-106557...

GHSA-9GVV-QJJ3-2P6G Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

CVE-2026-106558

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...