CVE-2026-106556
7.7
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Exploitability: 1.8 / Impact: 5.3
Source: security-advisories@github.com (Secondary)
Description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
Affected (9)
Products: Linuxfoundation: Backstage, Backstage Plugin Techdocs Node
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.50.5 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.14.6 |
Related CWEs
CWE-184
Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
References (5)
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
MitigationVendor Advisory
Timeline
No history available yet.