{"id":"CVE-2026-106509","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:06.463","lastModified":"2026-10-09T17:34:17.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-node","versions":[{"version":"< 1.14.6","status":"affected"},{"version":">= 1.15.0, < 1.15.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:01:39.138438Z","id":"CVE-2026-106509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1336"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.6","matchCriteriaId":"F5189301-5EC3-4F9F-952B-7993F3BFBF06"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionStartIncluding":"1.15.0","versionEndExcluding":"1.15.4","matchCriteriaId":"5CB4C5CD-5A68-42D5-AE7F-65362C0E7165"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.50.5","matchCriteriaId":"FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.1","versionEndExcluding":"1.54.6","matchCriteriaId":"949CA2FA-BF88-425F-910D-3D7E817E6420"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*","matchCriteriaId":"91628A7C-3017-4ACD-A100-330BB9F983B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*","matchCriteriaId":"C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*","matchCriteriaId":"8C1DE1E3-862E-4512-A66B-9804B2451D7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*","matchCriteriaId":"C5D0AF99-42C1-4AD2-84D6-11327EFD314B"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*","matchCriteriaId":"3796F724-6F1F-45CA-BB1F-5F2DCCC37986"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb","source":"security-advisories@github.com","tags":["Exploit","Patch"]},{"url":"https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d","source":"security-advisories@github.com","tags":["Exploit","Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c","source":"security-advisories@github.com","tags":["Vendor Advisory","Mitigation"]}]}