Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Impact
Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation.
Patches
Patched in@backstage/plugin-techdocs-node version 1.15.4
Workarounds
If you cannot upgrade immediately:
- Use Docker mode with restricted access: Configure TechDocs with
runIn: dockerinstead ofrunIn: local. This provides container isolation, though it does not fully mitigate the risk. - Limit repository write access to trusted parties, since exploitation requires the ability to commit files to a repository with TechDocs enabled.
- Review incoming changes to MkDocs configuration files as part of your code review process.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @backstage/plugin-techdocs-node | < 1.15.4 | 1.15.4 |
References
- https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx
- https://nvd.nist.gov/vuln/detail/CVE-2026-106505
- https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9
- https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db
- https://github.com/backstage/backstage
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L- Weakness (CWE)
CWE-426, CWE-436- Platform
- npm
- Package
@backstage/plugin-techdocs-node- Disclosed
- 07.10.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-p75x-jh7p-ppcx - CC BY 4.0
Vulnerability history: @backstage/plugin-techdocs-node
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 06.2022 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 8
- Medium 3
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 10
-
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.