CVE-2026-106509High· 7.7▾ TwilightBackstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to buil…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.
backstage_plugin-techdocs-node < 1.14.6backstage_plugin-techdocs-node >= 1.15.0, < 1.15.4backstage < 1.50.5backstage >= 1.51.1, < 1.54.6backstage = 1.51.0Upgrade past the affected range:
backstage_plugin-techdocs-node 1.15.4backstage 1.54.6Affected packages:
@backstage/plugin-techdocs-node < 1.15.4Patched in:
@backstage/plugin-techdocs-node 1.15.4Source: https://github.com/advisories/GHSA-8w7q-29mw-gf5c
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106505High· 7.7Backstage is an open framework for building developer portals
CVE-2026-88064High· 8.8Backstage is an open framework for building developer portals
CVE-2026-106510High· 7.7Backstage is an open framework for building developer portals
CVE-2026-106503High· 8.1Backstage is an open framework for building developer portals
CVE-2026-106501Critical· 9.6Backstage is an open framework for building developer portals
CVE-2026-106500High· 8.5Backstage is an open framework for building developer portals