CVE-2026-106510

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-07

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106510

EUVD

EUVD-2026-94369

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage_plugin-techdocs-node	to 1.14.6 (exc)
linuxfoundation	backstage_plugin-techdocs-node	From 1.15.0 (inc) to 1.15.4 (exc)
linuxfoundation	backstage	to 1.50.5 (exc)
linuxfoundation	backstage	From 1.51.1 (inc) to 1.54.6 (exc)
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-183	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

CVE-2026-106510 is a remote code execution vulnerability in the @backstage/plugin-techdocs-node package affecting versions before 1.14.6 and between 1.15.0 to 1.15.3. An authenticated user with catalog entity registration privileges can exploit a crafted mkdocs.yml file by including malicious markdown_extensions to execute arbitrary OS commands on the TechDocs build host during documentation generation.

Detection Guidance

Check Backstage TechDocs plugin versions for affected releases (<1.14.6 or >=1.15.0, <1.15.4). Inspect mkdocs.yml files in TechDocs configurations for dangerous markdown_extensions like subprocess:Popen, os:system, or plantuml_cmd. Use commands like grep -r 'subprocess:Popen' /path/to/techdocs/ or grep -r 'plantuml_cmd' /path/to/mkdocs.yml to search for suspicious entries.

Impact Analysis

This vulnerability allows an attacker with catalog entity registration access to execute arbitrary commands on the TechDocs build host. This could lead to unauthorized data access, system compromise, or disruption of documentation generation services. The impact includes high confidentiality breaches due to scope changes but lower integrity and availability impacts.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution on systems handling sensitive data. The remote code execution flaw allows attackers to run arbitrary commands on the TechDocs build host, which may process or store regulated information. This could lead to data breaches, unauthorized access, or data exfiltration, violating confidentiality requirements under GDPR and HIPAA.

Mitigation Strategies

Upgrade to patched versions 1.14.6 or 1.15.4 immediately. Temporarily switch to an external TechDocs builder to isolate build environments. Restrict catalog entity registration permissions to trusted users only. Audit all mkdocs.yml files for malicious markdown_extensions or theme configurations and remove unsafe entries like subprocess:Popen or plantuml_cmd.

Hi! I’m here to help you understand CVE-2026-106510. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70