CVE-2026-106509

Received Received - Intake

Code Execution in Backstage TechDocs Node Plugin

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-07

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-106509

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.50.5
backstage	backstage	>= 1.51.0-next.0, < 1.54.6
@backstage	plugin-techdocs-node	< 1.14.6
@backstage	plugin-techdocs-node	>= 1.15.0, < 1.15.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The vulnerability CVE-2026-106509 affects the @backstage/plugin-techdocs-node package due to improper validation of mkdocs theme configuration in TechDocs. A user with write access to a repository can include malicious configuration values in mkdocs.yml, leading to arbitrary code execution during the documentation build process.

Detection Guidance

To detect this vulnerability, check the version of the @backstage/plugin-techdocs-node package in your Backstage installation. If it is below 1.14.6 or 1.15.4, the system is vulnerable. Use commands like 'npm list @backstage/plugin-techdocs-node' or inspect package.json files for version details.

Impact Analysis

If you use Backstage with TechDocs configured to build documentation locally or in a container, an attacker with write access to a repository could execute arbitrary code during the build. This could lead to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data involved. Organizations using affected versions should update to patched versions to maintain compliance.

Mitigation Strategies

Upgrade the @backstage/plugin-techdocs-node package to version 1.14.6 or later. If using TechDocs, review mkdocs.yml files for untrusted configuration changes. Restrict write access to repositories containing TechDocs content to trusted users only.

Hi! I’m here to help you understand CVE-2026-106509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70