{"id":"CVE-2026-106556","published":"2026-10-07T15:17:12.960","lastModified":"2026-10-13T14:25:23.130","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","cwes":["CWE-78","CWE-184"],"vendors":["linuxfoundation"],"products":["backstage","backstage plugin-techdocs-node"],"references":[{"url":"https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg","tags":["Mitigation","Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg","tags":["Mitigation","Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"A configuration bypass vulnerability in Backstage's TechDocs package allows authenticated users to execute arbitrary commands during documentation builds by manipulating MkDocs configuration files. This represents a significant security risk as it can lead to remote code execution in the build environment.","exploitability":"Exploitation requires an authenticated user with permissions to register or modify documentation sources, and is moderately difficult due to the need for crafting malicious MkDocs configurations that bypass sanitization checks.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary commands on the TechDocs build servers, potentially leading to full system compromise of the documentation infrastructure and access to sensitive project information.","remediation":"Upgrade to version 1.14.6 or 1.15.4 of the @backstage/plugin-techdocs-node package to remediate this vulnerability.","detection":"Monitor for unusual file modifications in documentation source directories, particularly .mkdocs.yml files that contain unexpected command execution patterns, and watch for abnormal process execution logs from the TechDocs build containers.","tags":["rce","config-bypass","techdocs","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:59:45.114Z"}}