CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

CVE-2026-106455

The @backstage/plugin-techdocs-node package in Backstage (versions 0.11.12 through 1.14.7 and 1.15.5) is vulnerable to CWE-918 (Server-Side Request Forgery) due to improper validation of MkDocs plugin configurations. An authenticated attacker with control over a TechDocs source repository can tri...

CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

PT-2026-107244

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...

PT-2026-107304

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register...

PT-2026-107302

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains a flaw in the techdocs backend that allows a bypass of the mkdocs configuration sanitizer. Users capable of...

PT-2026-107305

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package allows potential file exposure when the local TechDocs publisher is used via the techdocs.publisher.type variable set to 'local'. In this configuration,...

PT-2026-107310

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Description The @backstage/plugin-techdocs-node package fails to properly validate the mkdocs theme configuration. When TechDocs is configured to build documentation locally or within a container, an attacker...

CVE-2026-88064

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-88064

Backstage is an open-source framework for building developer portals. The @backstage/plugin-techdocs-node package, prior to 1.14.6 and from 1.15.0 until 1.15.4, insufficiently validates mkdocs.yml files supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python ...

EUVD-2026-80784

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

PT-2026-93759

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions 1.15.0 through 1.15.4 Description The @backstage/plugin-techdocs-node package insufficiently validates the mkdocs.yml file provided by an authenticated user with permissions to register or...

CVE-2026-88064: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-29186: Unrestricted Upload of File with Dangerous Type

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.11-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.5-next.2) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.2-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.5-next.1 Source cves: CVE-2026-29186 Source advisory: OSV:GHSA-928R-FM4V-MVRW...

GHSA-6JR7-99PF-8VGF @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

Impact When TechDocs is configured with runIn: local, a malicious actor who can submit or modify a repository's mkdocs.yml file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. Patches Upgrade to @backstage/plugin-techdocs-node version 1.13.11, 1.14.1...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25153 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220), @techdocs/cli (>=0.0.0-nightly-20260123025240, <=0.0.0-nightly-20260126030220) potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (1.14.0)

@backstage/plugin-techdocs-node NPM version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-techdocs-backend =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240,...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.9-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.4-next.0) +2 more potentially affected by CVE-2026-25152 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.13.10-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.4-next.0 Source cves: CVE-2026-25152 Source advisory: OSV:GHSA-W669-JJ7H-88M9...