CVE-2026-106556CWE-184CWE-78command-injection

CVE-2026-106556

High · published October 7, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-07T19:17Z
Affected products (9)
ProductVersionsFixed in
linuxfoundation/backstage< 1.50.51.50.5
linuxfoundation/backstage≥ 1.51.1, < 1.54.61.54.6
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstageall versions—
linuxfoundation/backstage_plugin-techdocs-node< 1.14.61.14.6
linuxfoundation/backstage_plugin-techdocs-node≥ 1.15.0, < 1.15.41.15.4
References (5)
https://github.com/backstage/backstage/commit/25125ee727a3de3418a8fa6a9e458cd5b73ecf26 · [email protected]https://github.com/backstage/backstage/commit/b6d1aea0bef99b8dfec3c8746032474867ba677a · [email protected]https://github.com/backstage/backstage/releases/tag/v1.50.5 · [email protected]https://github.com/backstage/backstage/releases/tag/v1.54.6 · [email protected]https://github.com/backstage/backstage/security/advisories/GHSA-g2hj-v2j6-vfvg · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 14:39Z
    Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
    cvelistv5