11vulnerabilities
- Critical0 (0.0%)
- High8 (72.7%)
- Medium0 (0.0%)
- Moderate3 (27.3%)
- Low0 (0.0%)
backstage-plugin-techdocs-node
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 8HighAffects 10 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 4 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 7 vulnerabilities
- Critical: 0
- High: 6
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (11)
Known vulnerabilities affecting backstage-plugin-techdocs-node, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-4488-j8vj-vqqv | High | Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml### Impact An authenticated user who can register catalog entities can provide a crafted `mkdocs.yml` causing arbitrary OS command execution on the TechDocs build host when the docs are built. ### Patches Patched in `@backstage/plugin-techdocs-node`, version `1.15.4`. ### Workarounds If you cannot upgrade immediately: - Switch to `techdocs.builder: external` to isolate TechDocs builds in a container. - Restrict who can register catalog entities with TechDocs annotations. - Audit existing catalog entities for suspicious `markdown_extensions` values in their `mkdocs.yml` files. |
| GitHub (opens in a new tab) | |
| GHSA-8w7q-29mw-gf5c | High | Backstage: Improper validation of MkDocs theme configuration in TechDocs### Impact When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in `mkdocs.yml` that cause arbitrary code execution during the documentation build process. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4` ### Workarounds - Configure TechDocs with `techdocs.generator.runIn: 'docker'` instead of `'local'` to provide container isolation, though this does not fully mitigate the risk. - Restrict write access to repositories registered in the Backstage catalog t |
| GitHub (opens in a new tab) | |
| GHSA-cm77-ch27-6w6v | Moderate | Backstage has potential file exposure through local TechDocs publisher### Impact When using the local TechDocs publisher (`techdocs.publisher.type: 'local'`), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4` ### Workarounds If you cannot upgrade immediately, cons |
| GitHub (opens in a new tab) | |
| GHSA-f7v3-xhm6-w245 | High | Backstage has improper input validation in TechDocs Markdown extension configuration### Impact An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network resources. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4`. Adopters must also use `pymdown-extensions` version `10.21.3` or newer, normally through `mkdocs-techdocs-core` version `1.7.0` or newer. `@backstage/plugin-techdocs-node` does not control the Python dependencies used by the generato |
| GitHub (opens in a new tab) | |
| GHSA-p75x-jh7p-ppcx | High | Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend### Impact Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. ### Patches Patched in`@backstage/plugin-techdocs-node` version `1.15.4` ### Workarounds If you cannot upgrade immediately: - Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk. - Limit re |
| GitHub (opens in a new tab) | |
| GHSA-q38j-6vcm-2f5m | High | Backstage: Improper validation of MkDocs plugin configuration in TechDocs### Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. ### Patches Upgrade `@backstage/plugin-techdocs-node` to a patched version for the applicable release line: - `1.14.x`: upgrade to `1.14.7` or later in that line, available in |
| GitHub (opens in a new tab) | |
| GHSA-qmw3-745m-w99g | High | Backstage: Improper validation of TechDocs MkDocs configuration### Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4`. ### Workarounds Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review changes to documentation configuration before generation. |
| GitHub (opens in a new tab) | |
| GHSA-928r-fm4v-mvrw | High | TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution### Impact This is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. ### Patches Patched in `@backstage/plugin-techdocs-node` version 1.14.3 ### Workarounds If users cannot upgrade immediately: 1. Use Docker mode with restricted access: Configure TechD |
| GitHub (opens in a new tab) | |
| GHSA-6jr7-99pf-8vgf | High | @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks### Impact When TechDocs is configured with `runIn: local`, a malicious actor who can submit or modify a repository's `mkdocs.yml` file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. ### Patches Upgrade to `@backstage/plugin-techdocs-node` version 1.13.11, 1.14.1 or later. The fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (including `hooks`) are now removed from `mkdocs.yml` before running the generator, with a warning logged to indicate which keys were removed. **Note**: Users of `@techdoc |
| GitHub (opens in a new tab) | |
| GHSA-w669-jj7h-88m9 | Moderate | @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator### Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. ### Patches This vulnerability is fixed in` @backstage/plugin-techdocs-node` version X.X.X. Users should upgrade to this version or later. ### Workaro |
| GitHub (opens in a new tab) |
- GHSA-4488-j8vj-vqqvHighBackstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
< 1.15.4
### Impact An authenticated user who can register catalog entities can provide a crafted `mkdocs.yml` causing arbitrary OS command execution on the TechDocs build host when the docs are built. ### Patches Patched in `@backstage/plugin-techdocs-node`, version `1.15.4`. ### Workarounds If you cannot upgrade immediately: - Switch to `techdocs.builder: external` to isolate TechDocs builds in a container. - Restrict who can register catalog entities with TechDocs annotations. - Audit existing catalog entities for suspicious `markdown_extensions` values in their `mkdocs.yml` files.
CVE: CVE-2026-106510
- GHSA-8w7q-29mw-gf5cHighBackstage: Improper validation of MkDocs theme configuration in TechDocs
< 1.15.4
### Impact When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in `mkdocs.yml` that cause arbitrary code execution during the documentation build process. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4` ### Workarounds - Configure TechDocs with `techdocs.generator.runIn: 'docker'` instead of `'local'` to provide container isolation, though this does not fully mitigate the risk. - Restrict write access to repositories registered in the Backstage catalog t
CVE: CVE-2026-106509
- GHSA-cm77-ch27-6w6vModerateBackstage has potential file exposure through local TechDocs publisher
< 1.15.4
### Impact When using the local TechDocs publisher (`techdocs.publisher.type: 'local'`), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4` ### Workarounds If you cannot upgrade immediately, cons
CVE: CVE-2026-106508
- GHSA-f7v3-xhm6-w245HighBackstage has improper input validation in TechDocs Markdown extension configuration
< 1.15.4
### Impact An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary. Depending on deployment configuration, this may expose sensitive backend-host data or internal network resources. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4`. Adopters must also use `pymdown-extensions` version `10.21.3` or newer, normally through `mkdocs-techdocs-core` version `1.7.0` or newer. `@backstage/plugin-techdocs-node` does not control the Python dependencies used by the generato
CVE: CVE-2026-106557
- GHSA-p75x-jh7p-ppcxHighBackstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
< 1.15.4
### Impact Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. ### Patches Patched in`@backstage/plugin-techdocs-node` version `1.15.4` ### Workarounds If you cannot upgrade immediately: - Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk. - Limit re
CVE: CVE-2026-106505
- GHSA-q38j-6vcm-2f5mHighBackstage: Improper validation of MkDocs plugin configuration in TechDocs
>= 0.11.12, < 1.14.7>= 1.15.0, < 1.15.5
### Impact An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. ### Patches Upgrade `@backstage/plugin-techdocs-node` to a patched version for the applicable release line: - `1.14.x`: upgrade to `1.14.7` or later in that line, available in
CVE: CVE-2026-106455
- GHSA-qmw3-745m-w99gHighBackstage: Improper validation of TechDocs MkDocs configuration
< 1.15.4
### Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. ### Patches Patched in `@backstage/plugin-techdocs-node` version `1.15.4`. ### Workarounds Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review changes to documentation configuration before generation.
CVE: CVE-2026-106558
- GHSA-928r-fm4v-mvrwHighTechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
< 1.14.3
### Impact This is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. ### Patches Patched in `@backstage/plugin-techdocs-node` version 1.14.3 ### Workarounds If users cannot upgrade immediately: 1. Use Docker mode with restricted access: Configure TechD
CVE: CVE-2026-29186
- GHSA-6jr7-99pf-8vgfHigh@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
>= 1.14.0, < 1.14.1< 1.13.11
### Impact When TechDocs is configured with `runIn: local`, a malicious actor who can submit or modify a repository's `mkdocs.yml` file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. ### Patches Upgrade to `@backstage/plugin-techdocs-node` version 1.13.11, 1.14.1 or later. The fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (including `hooks`) are now removed from `mkdocs.yml` before running the generator, with a warning logged to indicate which keys were removed. **Note**: Users of `@techdoc
CVE: CVE-2026-25153
- GHSA-w669-jj7h-88m9Moderate@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
>= 1.14.0, < 1.14.1< 1.13.11
### Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation. ### Patches This vulnerability is fixed in` @backstage/plugin-techdocs-node` version X.X.X. Users should upgrade to this version or later. ### Workaro
CVE: CVE-2026-25152