CVE-2026-88064
HighCVSS 8.8Summary
Backstage (@backstage/plugin-techdocs-node) before versions 1.14.6 and 1.15.0-1.15.4 insufficiently validates mkdocs.yml, which can lead to unintended code execution via unsafe YAML tags, markdown_extensions configuration, and other options.
Risk Assessment
An attacker can gain access to files, credentials, and resources available to the TechDocs backend or build container, potentially leading to confidentiality and integrity compromise.
Recommendation
Upgrade @backstage/plugin-techdocs-node to version 1.14.6 or 1.15.4 to mitigate the vulnerability.
Other vulnerabilities in @backstage/plugin-techdocs-node
See all- CVE-2026-29186High
A vulnerability in @backstage/plugin-techdocs-node allows bypassing the allowlist of MkDocs configuration keys, leading to arbitrary Python code execution during documentation builds. The issue is fixed in version 1.14.3.
- CVE-2026-25153High
A vulnerability in @backstage/plugin-techdocs-node allows an attacker to execute arbitrary Python code on the TechDocs build server via a malicious `mkdocs.yml` configuration. The issue affects versions prior to 1.13.11 and 1.14.1 when using `runIn: local`.
Original NVD description (English source)
Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the documentation generator and cause unintended code execution. The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.