Backstage TechDocs: Code execution via mkdocs.yml configuration

Summary

The TechDocs plugin of Backstage (@backstage/plugin-techdocs-node) does not properly validate MkDocs theme configuration. If TechDocs builds documentation locally or in a container, a user with write access to a repository registered in Backstage can add configuration values to mkdocs.yml that execute arbitrary code during the documentation build. Exploitation requires an authenticated account with repository write access; unauthenticated exploitation is not described. A successful attack can compromise the build environment and anything it can reach, such as CI secrets.

Affected

• @backstage/plugin-techdocs-node: before 1.14.6, and 1.15.0 before 1.15.4
• backstage (core): before 1.50.5, and 1.51.0-next.0 before 1.54.6

Fixed in

• @backstage/plugin-techdocs-node: 1.14.6 (1.14 line), 1.15.4 (1.15 line)
• backstage (core): 1.50.5 and 1.54.6 (per release tags; confirm exact versions in the release notes)

Workaround

• Set techdocs.generator.runIn to 'docker' instead of 'local'. This provides container isolation but does not fully mitigate the risk.
• Restrict write access to repositories registered in the Backstage catalog to trusted users.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact partial.
• No known exploitation or public proof of concept found at the time of writing.

Our recommendation

• Check whether Backstage with TechDocs is deployed and look for @backstage/plugin-techdocs-node and the backstage core package in lockfiles and container images.
• Upgrade to the fixed versions listed above and rebuild container images.
• Until patched, limit repository write access to trusted users and review which secrets build jobs can read.
• Monitor CISA KEV and the GitHub advisory for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-8w7q-29mw-gf5c github.com
• Fixing commit 02cd7cd github.com
• Fixing commit a900a99 github.com
• Backstage release v1.50.5 github.com
• Backstage release v1.54.6 github.com
• OSV entry CVE-2026-106509 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:34.