CVE-2026-106510
7.7
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Exploitability: 1.8 / Impact: 5.3
Source: security-advisories@github.com (Secondary)
Description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
Affected (9)
Products: Linuxfoundation: Backstage Plugin Techdocs Node, Backstage
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.14.6 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.50.5 |
Related CWEs
CWE-183
Permissive List of Allowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
References (5)
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
MitigationVendor Advisory
Timeline
No history available yet.