CVE-2026-106510CWE-183CWE-470

CVE-2026-106510

High · published October 7, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weaknesses
CWE-183 · Permissive List of Allowed Inputs; CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-10-07T19:17Z
Affected products (9)
ProductVersionsFixed in
linuxfoundation/backstage_plugin-techdocs-node< 1.14.61.14.6
linuxfoundation/backstage_plugin-techdocs-node≥ 1.15.0, < 1.15.41.15.4
linuxfoundation/backstage< 1.50.51.50.5
linuxfoundation/backstage≥ 1.51.1, < 1.54.61.54.6
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
References (5)
https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb · [email protected]https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d · [email protected]https://github.com/backstage/backstage/releases/tag/v1.50.5 · [email protected]https://github.com/backstage/backstage/releases/tag/v1.54.6 · [email protected]https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 14:36Z
    Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
    cvelistv5