CVE-2026-106558

highPriorität · verfolgen · 0EPSS 0.005 · 40. PerzentilUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 8.8 · high

Is it mine?

9 products

Prüfe deine Angriffsfläche

Who says so?

2 sources

nvd · osv

EPSS · bewertet 2026-10-27

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USCWE-502US

betroffene Produkte (9)

Betroffene Produkte und Versionsbereiche.

linuxfoundation backstage< 1.50.7nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage= 1.51.0nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage1.51.1 → 1.54.8nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage= 1.55.0nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage1.55.1 → 1.55.2nvdUScpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
linuxfoundation backstage plugin-techdocs-node< 1.14.8nvdUScpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*
linuxfoundation backstage plugin-techdocs-node1.15.0 → 1.15.6nvdUScpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*
linuxfoundation backstage plugin-techdocs-node2.0.0 → 2.0.1nvdUScpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*
npm @backstage/plugin-techdocs-node< 1.15.4osvUSpkg:npm/%40backstage/plugin-techdocs-node

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-qmw3-745m-w99gBackstage: Improper validation of TechDocs MkDocs configuration2026-10-07ghsa · osvUS
### Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4`. ### Workarounds Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review changes to documentation configuration before generation.

quellen

Welche Quellen diesen Datensatz belegen und wann.

nvd osv NVD CVE.org MITRE

veröffentlicht 2026-10-07geändert 2026-10-13

Referenzen (7) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91bPatch
https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709Patch
https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310cPatch
https://github.com/backstage/backstage/releases/tag/v1.50.7PatchRelease Notes
https://github.com/backstage/backstage/releases/tag/v1.54.9PatchRelease Notes
https://github.com/backstage/backstage/releases/tag/v1.55.2PatchRelease Notes
https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99gMitigationVendor Advisory

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan