CVE-2026-106556

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-07

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-13

Generated

2026-11-08

AI Q&A

2026-10-07

EPSS Evaluated

2026-11-07

NVD

CVE-2026-106556

EUVD

EUVD-2026-94370

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage	to 1.50.5 (exc)
linuxfoundation	backstage	From 1.51.1 (inc) to 1.54.6 (exc)
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage	1.51.0
linuxfoundation	backstage_plugin-techdocs-node	to 1.14.6 (exc)
linuxfoundation	backstage_plugin-techdocs-node	From 1.15.0 (inc) to 1.15.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability is a configuration bypass in the TechDocs plugin for Backstage. It affects the mkdocs.yml sanitization process during documentation generation in versions prior to 1.14.6 and between 1.15.0 and 1.15.3. Insufficient validation allows authenticated users who can modify documentation sources to execute arbitrary commands in the build environment.

Detection Guidance

Check Backstage and TechDocs plugin versions. Run: npm list @backstage/plugin-techdocs-node. If version is below 1.14.6 or between 1.15.0-1.15.3, the system is vulnerable. Inspect mkdocs.yml files for unsafe Python YAML tags like !!python/name:builtins.str or !!python/object/apply:builtins.str.

Impact Analysis

An attacker with access to modify documentation sources could execute arbitrary commands within the TechDocs build environment. This could lead to unauthorized code execution, data exfiltration, or disruption of services limited to the TechDocs backend or build container.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized command execution in the build environment. If exploited, it may lead to unauthorized access to sensitive data processed or stored within the TechDocs backend or build container, violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade @backstage/plugin-techdocs-node to version 1.14.6 or 1.15.4 or later. If immediate upgrade is not possible, enable Docker mode with restricted access, restrict repository access to trusted contributors, or implement manual review for mkdocs.yml changes. Disable unsafe Python YAML tags in MkDocs configurations.

Hi! I’m here to help you understand CVE-2026-106556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...