CVE-2026-106505
8.5
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 6.0
Source: NVD
Description
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
Affected (9)
Products: Linuxfoundation: Backstage Plugin Techdocs Node, Backstage
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.14.6 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.50.5 |
Related CWEs
CWE-426
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-436
Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References (5)
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
MitigationVendor Advisory
Timeline
No history available yet.