@backstage/plugin-techdocs-node: Code execution via Markdown extensions
Summary
The TechDocs node library of Backstage does not properly validate mapping-style markdown_extensions in MkDocs configuration. An authenticated user who can register or influence an SCM-backed documentation source can bypass sanitization and make Python objects be imported and instantiated during documentation generation, which can lead to arbitrary code execution. Impact is greatest where generation runs with backend credentials, filesystem access or internal network access.
Affected
- @backstage/plugin-techdocs-node below 1.14.8
- @backstage/plugin-techdocs-node 1.15.0 to below 1.15.6
- @backstage/plugin-techdocs-node 2.0.0 to below 2.0.1
- Backstage repository below 1.50.7, 1.51.0-next.0 to below 1.54.9, and 1.55.0-next.0 to below 1.55.2
Fixed in
- @backstage/plugin-techdocs-node 1.14.8, 1.15.6 or 2.0.1 (Backstage v1.50.7, v1.54.9 or v1.55.2)
- The earlier fix in 1.15.4 is incomplete and not sufficient.
Workaround
- Use external TechDocs generation in an isolated environment without sensitive credentials or host access.
- Restrict and review changes to documentation configuration before generation.
Exploitation
- No public exploit and no known active exploitation found at the time of research.
- CISA SSVC: exploitation none, automatable no, total technical impact.
Our recommendation
- Upgrade @backstage/plugin-techdocs-node to a fixed version for the package line in use. Do not stop at 1.15.4.
- Check whether TechDocs generation runs locally on the backend (runIn: local), as this is the most exposed setup.
- Limit who can add or change documentation sources, and review changes to the mkdocs configuration.
- Expect configuration friction after the upgrade, as the tag allowlist may affect some mkdocs-material setups.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qmw3-745m-w99g github.com
- Fix commit 32723a0 (normalize TechDocs Markdown extension configuration) github.com
- Backstage release v1.50.7 github.com
- Backstage release v1.54.9 github.com
- Backstage release v1.55.2 github.com
- OSV entry CVE-2026-106558 osv.dev
- HOL Guard CVE-2026-106558 hol.org
- VulDB CVE-2026-106558 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:22.
Original description (NVD)
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.
NVD references (7)
- https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b
- https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709
- https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c
- https://github.com/backstage/backstage/releases/tag/v1.50.7
- https://github.com/backstage/backstage/releases/tag/v1.54.9
- https://github.com/backstage/backstage/releases/tag/v1.55.2
- https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.