381 matches found
Arbitrary Code Injection
Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Arbitrary Code Injection via the processing of MkDocs hooks, when TechDocs is configured wit...
CVE-2026-25153 @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...
CVE-2026-25153
In CVE-2026-25153, versions of @backstage/plugin-techdocs-node before 1.13.11 and before 1.14.1 are vulnerable when TechDocs runs with runIn: local. A malicious actor who can submit or modify a repository’s mkdocs.yml can cause arbitrary Python code execution on the TechDocs build server via MkDo...
EUVD-2026-5004
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...
CVE-2026-25153 @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...
CVE-2026-25153
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...
CVE-2026-25152: Improper Limitation of a Pathname to a Restricted Directory
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...
PT-2026-5494
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.13.11 and 1.14.1 Description Backstage is a framework for building developer portals, and @backstage/plugin-techdocs-node provides functionalities for TechDocs. A path traversal issue exists in the TechDocs local...
CVE-2026-25153: Improper Control of Generation of Code
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...
PT-2026-5463
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.13.11 and versions prior to 1.14.1 Description Backstage’s @backstage/plugin-techdocs-node component, used for TechDocs, is susceptible to remote code execution. When TechDocs is configured to run locally runIn:...
mkdocs-techdocs-core (>=0.0.6, <=0.0.7) potentially affected by CVE-2025-68142 via pymdown-extensions (8.0.0)
pymdown-extensions PYPI version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core =0.0.6, =0.0.7 Source cves: CVE-2025-68142 Source advisory: OSV:GHSA-R6H4-MM7H-8PMQ...
labext-pkg (2.1.1), mkdocs-techdocs-core (>=0.2.3, <=1.0.1) potentially affected by CVE-2025-68142 via pymdown-extensions (9.0.0)
pymdown-extensions PYPI version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - labext-pkg 2.1.1 - mkdocs-techdocs-core =0.2.3, =1.0.1 Source cves: CVE-2025-68142 Source advisory: OSV:GHSA-R6H4-MM7H-8PMQ...
blog-vi (0.2.6), django-apirouter (>=0.1.0, <=0.2.1) +5 more potentially affected by CVE-2025-68142 via pymdown-extensions (7.1.0)
pymdown-extensions PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - blog-vi 0.2.6 - django-apirouter =0.1.0, =2.1.0, =0.0.4, =0.10.2, =1.4.0, =1.7.0 Source cves: CVE-2025-68142 Source advisory...
mkdocs-material (8.2.11), mkdocs-techdocs-bandicoot (>=1.1.7, <=1.1.9) +1 more potentially affected by CVE-2025-68142 via pymdown-extensions (9.3.0)
pymdown-extensions PYPI version 9.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-material 8.2.11 - mkdocs-techdocs-bandicoot =1.1.7, =1.0.2, =1.1.7 Source cves: CVE-2025-68142 Source advisory:...
mkdocs-techdocs-core (1.2.0) potentially affected by CVE-2025-68142 via pymdown-extensions (9.9.1)
pymdown-extensions PYPI version 9.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core 1.2.0 Source cves: CVE-2025-68142 Source advisory: OSV:GHSA-R6H4-MM7H-8PMQ...
EUVD-2021-1373
Malware in sbrugna...
EUVD-2021-1371
Malware in sbrugna...
EUVD-2021-1324
Malware in sbrugna...