backstage @backstage/plugin-techdocs-node vulnerabilities

Latest backstage @backstage/plugin-techdocs-node CVEs

Newest publication first

1. CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

   Published 2026-10-07

   High·CVSS 7.7 EPSS 0.38%

   Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources m...

2. CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

   Published 2026-10-07

   High·CVSS 8.8 EPSS 0.47%

   Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-back...

3. CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

   Published 2026-10-07

   High·CVSS 7.7 EPSS 0.26%

   Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could al...

4. CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

   Published 2026-10-07

   High·CVSS 7.7 EPSS 0.48%

   Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can pro...

5. CVE-2026-106509 Backstage: Improper validation of MkDocs theme configuration in TechDocs

   Published 2026-10-06

   High·CVSS 8.8 EPSS 0.52%

   Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container,...

6. CVE-2026-106508 Backstage: Potential file exposure through local TechDocs publisher

   Published 2026-10-06

   Medium·CVSS 6.5 EPSS 0.39%

   Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was...

7. CVE-2026-106505 Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

   Published 2026-10-06

   High·CVSS 8.5 EPSS 0.31%

   Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses T...

8. CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

   Published 2026-10-06

   High·CVSS 7.7 EPSS 0.42%

   Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs s...

9. CVE-2026-29186 @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

   Published 2026-03-07

   Critical·CVSS 9.8

   Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys...

10. CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

    Published 2026-01-30

    Medium·CVSS 6.5

    Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs loca...

11. CVE-2026-25153 @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

    Published 2026-01-30

    High·CVSS 8.8

    Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a ma...

12. GHSA-4jqc-jvh2-pxg9 Path traversal for local publishers in TechDocs backend

    Published 2022-06-17

    Unknown

    Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catal...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.