CVE-2026-106505

high

Backstage is an open framework for building developer portals.

Vendor / product: Linuxfoundation — backstage plugin-techdocs-node

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.

CVSS

8.5

8.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-10-06 22:17

Modified: 2026-10-09 17:58

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:58 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linuxfoundation / backstage_plugin-techdocs-node <1.14.6, ≥1.15.0 <1.15.4

linuxfoundation / backstage <1.50.5, ≥1.51.1 <1.54.6, 1.51.0

Weakness classification (CWE)

CWE-426 CWE-436

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx

Patch / mitigation: https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9

Patch / mitigation: https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db

Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.50.5

Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6

Patch / mitigation: https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx

References

https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9 security-advisories@github.com
https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db security-advisories@github.com
https://github.com/backstage/backstage/releases/tag/v1.50.5 security-advisories@github.com
https://github.com/backstage/backstage/releases/tag/v1.54.6 security-advisories@github.com
https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-106505

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs