CVE-2026-106505

Analyzed Analyzed - Analysis Complete

Code Execution Bypass in Backstage TechDocs Node

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106505

EUVD

EUVD-2026-94070

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage_plugin-techdocs-node	to 1.14.6 (exc)
linuxfoundation	backstage_plugin-techdocs-node	From 1.15.0 (inc) to 1.15.4 (exc)
linuxfoundation	backstage	to 1.50.5 (exc)
linuxfoundation	backstage	From 1.51.1 (inc) to 1.54.6 (exc)
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The @backstage/plugin-techdocs-node package before versions 1.14.6 and 1.15.4 has a vulnerability where users with commit access to a repository using TechDocs can bypass the MkDocs configuration sanitizer. This allows them to execute arbitrary code on the TechDocs backend host during documentation generation.

Detection Guidance

This vulnerability can be detected by checking the version of the @backstage/plugin-techdocs-node package. If your system is running a version prior to 1.14.6 or 1.15.4, it is vulnerable. Use commands like 'npm list @backstage/plugin-techdocs-node' or 'yarn list @backstage/plugin-techdocs-node' to check the installed version.

Impact Analysis

If you use Backstage with TechDocs and allow users to commit changes to repositories, an attacker with such access could exploit this flaw to run malicious code on your TechDocs backend server. This could lead to unauthorized access, data breaches, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) or HIPAA (health information security) if personal or health data is compromised due to the breach.

Mitigation Strategies

Update the @backstage/plugin-techdocs-node package to version 1.14.6 or 1.15.4 or later to address the bypass vulnerability in the MkDocs configuration sanitizer.

Hi! I’m here to help you understand CVE-2026-106505. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70