CVE-2026-106557

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container.

In Backstage prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package has improper validation of mkdocs theme configuration. A user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during documentation build.

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through the local techdocs publisher. When using the local TechDocs publisher, the documentation serving endpoint could follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions not arising through normal MkDocs operation. Cloud-based publishers are not affected. Fixed in version 1.15.4.

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. Fixed in version 1.15.4.

In Backstage prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer. Users with ability to commit changes to a TechDocs repository can circumvent the sanitizer and execute arbitrary code on the TechDocs backend host during documentation generation.

The @backstage/plugin-techdocs-node package from 0.11.12 until 1.14.7 and 1.15.5 has improper validation of mkdocs plugin configuration in TechDocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment.

Backstage (@backstage/plugin-techdocs-node) before versions 1.14.6 and 1.15.0-1.15.4 insufficiently validates mkdocs.yml, which can lead to unintended code execution via unsafe YAML tags, markdown_extensions configuration, and other options.

A vulnerability in @backstage/plugin-techdocs-node allows bypassing the allowlist of MkDocs configuration keys, leading to arbitrary Python code execution during documentation builds. The issue is fixed in version 1.14.3.

A vulnerability in @backstage/plugin-techdocs-node allows an attacker to execute arbitrary Python code on the TechDocs build server via a malicious `mkdocs.yml` configuration. The issue affects versions prior to 1.13.11 and 1.14.1 when using `runIn: local`.