Backstage: Improper validation of TechDocs MkDocs configuration
### Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4`. ### Workarounds Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review changes to documentation configuration before generation.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106558US | — | — | ||
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style ma… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/backstage/backstagePACKAGE
- https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91bWEB
- https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709WEB
- https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310cWEB
- https://github.com/backstage/backstage/releases/tag/v1.50.7WEB
- https://github.com/backstage/backstage/releases/tag/v1.54.9WEB
- https://github.com/backstage/backstage/releases/tag/v1.55.2WEB
- https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99gWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan