CVE-2026-106558

A flaw was found in @backstage/plugin-techdocs-node. An authenticated attacker with permissions to register or modify documentation in a source code management SCM repository can bypass configuration sanitization checks. By providing a crafted markdown extension configuration, the attacker can...

CVE-2026-106510

A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers...

CVE-2026-106556

A flaw was found in the Backstage plugin-techdocs-node component. Insufficient validation of documentation configuration files during documentation generation allows sanitization checks to be bypassed. An authenticated user with permission to register or modify documentation sources can exploit...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825496...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825496...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: GHSA-Q38J-6VCM-2F5M...

GHSA-Q38J-6VCM-2F5M Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

EUVD-2026-93986

Backstage: Improper validation of MkDocs plugin configuration in TechDocs...

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: GHSA-4488-J8VJ-VQQV...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106510 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825498...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: OSV:GHSA-4488-J8VJ-VQQV...

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825498...

GHSA-4488-J8VJ-VQQV Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106558 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106558 Source advisory: OSV:GHSA-QMW3-745M-W99G...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106558 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106558 Source advisory: GHSA-QMW3-745M-W99G...