CVE-2026-106510
Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Backstage TechDocs Node Plugin

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-106510
EUVD
EUVD-2026-94369

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
backstage backstage < 1.50.5
backstage backstage >= 1.51.0-next.0, < 1.54.6
@backstage plugin-techdocs-node < 1.14.6
@backstage plugin-techdocs-node >= 1.15.0, < 1.15.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-183 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-106510 is a remote code execution vulnerability in the @backstage/plugin-techdocs-node package affecting versions before 1.14.6 and between 1.15.0 to 1.15.3. An authenticated user with catalog entity registration privileges can exploit a crafted mkdocs.yml file by including malicious markdown_extensions to execute arbitrary OS commands on the TechDocs build host during documentation generation.

Detection Guidance

Check Backstage TechDocs plugin versions for affected releases (<1.14.6 or >=1.15.0, <1.15.4). Inspect mkdocs.yml files in TechDocs configurations for dangerous markdown_extensions like subprocess:Popen, os:system, or plantuml_cmd. Use commands like grep -r 'subprocess:Popen' /path/to/techdocs/ or grep -r 'plantuml_cmd' /path/to/mkdocs.yml to search for suspicious entries.

Impact Analysis

This vulnerability allows an attacker with catalog entity registration access to execute arbitrary commands on the TechDocs build host. This could lead to unauthorized data access, system compromise, or disruption of documentation generation services. The impact includes high confidentiality breaches due to scope changes but lower integrity and availability impacts.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution on systems handling sensitive data. The remote code execution flaw allows attackers to run arbitrary commands on the TechDocs build host, which may process or store regulated information. This could lead to data breaches, unauthorized access, or data exfiltration, violating confidentiality requirements under GDPR and HIPAA.

Mitigation Strategies

Upgrade to patched versions 1.14.6 or 1.15.4 immediately. Temporarily switch to an external TechDocs builder to isolate build environments. Restrict catalog entity registration permissions to trusted users only. Audit all mkdocs.yml files for malicious markdown_extensions or theme configurations and remove unsafe entries like subprocess:Popen or plantuml_cmd.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart