{"id":"CVE-2026-106505","title":"Backstage is an open framework for building developer portals","summary":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","cwe":["CWE-426","CWE-436","CWE-94"],"vendor":"linuxfoundation","product":"backstage_plugin-techdocs-node","affected":["backstage_plugin-techdocs-node < 1.14.6","backstage_plugin-techdocs-node >= 1.15.0, < 1.15.4","backstage < 1.50.5","backstage >= 1.51.1, < 1.54.6","backstage = 1.51.0"],"patched":["backstage_plugin-techdocs-node 1.15.4","backstage 1.54.6"],"published":"2026-10-06","updated":"2026-10-09","sourceUpdated":"2026-10-09T17:58:21.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106505","references":[{"url":"https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9","label":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db","label":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","label":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","label":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106505"},{"url":"https://github.com/advisories/GHSA-p75x-jh7p-ppcx"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106505.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-106505"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547230"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106505"}],"tags":["nvd","ghsa","npm","cve.org","csaf","vex","red-hat"],"epss":0.00312,"epssPercentile":0.23913,"aliases":["GHSA-p75x-jh7p-ppcx"],"ecosystem":"npm","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-07T16:12:41.246162Z"},"scores":{"nvd":7.7,"vendor":6.3,"ghsa":7.7},"ingestedAt":"2026-10-06T22:23:15.968Z","slug":"CVE-2026-106505","body":"## Overview\n\nBackstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.\n\n## Affected\n\n- `backstage_plugin-techdocs-node < 1.14.6`\n- `backstage_plugin-techdocs-node >= 1.15.0, < 1.15.4`\n- `backstage < 1.50.5`\n- `backstage >= 1.51.1, < 1.54.6`\n- `backstage = 1.51.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `backstage_plugin-techdocs-node 1.15.4`\n- `backstage 1.54.6`\n\n## Package advisory (CVE-2026-106505)\n\nAffected packages:\n\n- `@backstage/plugin-techdocs-node < 1.15.4`\n\nPatched in:\n\n- `@backstage/plugin-techdocs-node 1.15.4`\n\nSource: https://github.com/advisories/GHSA-p75x-jh7p-ppcx\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106505.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}