@backstage/plugin-techdocs-node vulnerabilities

Backstage (@backstage/plugin-techdocs-node) before versions 1.14.6 and 1.15.0-1.15.4 insufficiently validates mkdocs.yml, which can lead to unintended code execution via unsafe YAML tags, markdown_extensions configuration, and other options.

A vulnerability in @backstage/plugin-techdocs-node allows bypassing the allowlist of MkDocs configuration keys, leading to arbitrary Python code execution during documentation builds. The issue is fixed in version 1.14.3.

A vulnerability in @backstage/plugin-techdocs-node allows an attacker to execute arbitrary Python code on the TechDocs build server via a malicious `mkdocs.yml` configuration. The issue affects versions prior to 1.13.11 and 1.14.1 when using `runIn: local`.