{"id":"CVE-2026-106505","aliases":["EUVD-2026-94070","GHSA-p75x-jh7p-ppcx"],"status":"published","title":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00312,"percentile":0.24396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-426","CWE-436"],"published":"2026-10-06T21:43:08Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"npm","package":"@backstage/plugin-techdocs-node","fixed_in":["1.15.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@backstage/plugin-techdocs-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@backstage/plugin-techdocs-node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.4"}]}]}],"products":[{"vendor":"@backstage","product":"plugin-techdocs-node"},{"vendor":"backstage","product":"backstage"},{"vendor":"linuxfoundation","product":"backstage"},{"vendor":"linuxfoundation","product":"backstage_plugin-techdocs-node"}],"references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":["x_refsource_MISC","Patch","Release Notes","web"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":["x_refsource_MISC","Patch","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106505","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p75x-jh7p-ppcx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106505.json","tags":["advisory"]},{"url":"https://github.com/backstage/backstage","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-106505","title":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","status":"published","published":"2026-10-06T21:43:08.37Z","modified":"2026-10-07T16:14:14.192Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-426","CWE-436"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-94070","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","status":"published","published":"2026-10-06T21:43:08Z","modified":"2026-10-07T16:14:14Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:35.164729Z"}],"ghsa":[{"id":"GHSA-p75x-jh7p-ppcx","title":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","description":"### Impact\n\nUsers with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation.\n\n### Patches\n\nPatched in`@backstage/plugin-techdocs-node` version `1.15.4`\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk.\n- Limit repository write access to trusted parties, since exploitation requires the ability to commit files to a repository with TechDocs enabled.\n- Review incoming changes to MkDocs configuration files as part of your code review process.","status":"published","published":"2026-10-07T16:23:52Z","modified":"2026-10-07T16:23:54Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-426","CWE-436"],"updated_at":"2026-11-02T14:41:28.013673Z"}],"nvd":[{"id":"CVE-2026-106505","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","status":"published","published":"2026-10-06T22:17:05.837Z","modified":"2026-10-09T17:58:21.97Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-426","CWE-436"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"CVE-2026-106505","title":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","status":"published","published":"2026-10-06T21:43:08.37Z","modified":"2026-10-28T02:30:24.243492489Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-426","CWE-436"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-p75x-jh7p-ppcx","title":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","description":"### Impact\n\nUsers with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation.\n\n### Patches\n\nPatched in`@backstage/plugin-techdocs-node` version `1.15.4`\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk.\n- Limit repository write access to trusted parties, since exploitation requires the ability to commit files to a repository with TechDocs enabled.\n- Review incoming changes to MkDocs configuration files as part of your code review process.","status":"published","published":"2026-10-07T16:23:52Z","modified":"2026-10-07T16:30:05.289295195Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-426","CWE-436"],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}