CVE-2026-106505
HIGH
7,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: low
Availability: low
Description
AI Translation Available
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
426
Untrusted Search Path
StableCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Dos: Crash, Exit, Or Restart
Read Files Or Directories
Applicable Platforms
All platforms may be affected
436
Interpretation Conflict
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Other
Potential Impacts:
Unexpected State
Varies By Context
Applicable Platforms
All platforms may be affected
https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b069…
https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c…
https://github.com/backstage/backstage/releases/tag/v1.50.5
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx