{"id":"EUVD-2026-94070","enisaUuid":"1da0d3af-aa09-3697-bb8d-613b19dd95da","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","datePublished":"Oct 6, 2026, 9:43:08 PM","dateUpdated":"Oct 7, 2026, 4:14:14 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx\nhttps://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9\nhttps://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106505\nGHSA-p75x-jh7p-ppcx\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"549292f3-5cb4-3508-99d4-5966a0a56a83","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"},{"id":"6f936b72-15e7-33a5-b46e-17bbfe2327c5","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"a7597dbf-77e3-33d0-be83-244cbc08b4e3","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"f30a6899-b18d-3044-b941-4593181767d6","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"}],"enisaIdVendor":[{"id":"82351bd7-0583-3c5e-b352-003697bf40a7","vendor":{"name":"@backstage"}},{"id":"fb2b1382-03f1-3561-87ba-e543d0e79429","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"4815242c-b667-3654-b370-fb8864b7432d","vulnerability":{"id":"CVE-2026-106505","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.","datePublished":"Oct 6, 2026, 9:43:08 PM","dateUpdated":"Oct 7, 2026, 4:14:14 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx\nhttps://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9\nhttps://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94070\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 29, 2026, 7:16:09 AM","vulnerabilityProduct":[{"id":"0e31ff6d-3412-31de-a007-7374aa505c5f","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"},{"id":"2dc8eb6a-8ccd-3869-a853-6b6457c41f07","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"4ede5b8e-d33f-39e0-9fee-dc9f2ba2361b","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"fb20c44b-9fb9-3dd6-b34d-1bd52e1a20ac","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"}],"vulnerabilityVendor":[{"id":"204d447f-a745-3cd9-a362-2138960ed9e2","vendor":{"name":"@backstage"}},{"id":"ba4749c1-7c6f-3b30-b52e-747779ad3ec5","vendor":{"name":"backstage"}}]}},{"id":"d4b59207-2ddb-36f7-b9f2-a4136481ed30","vulnerability":{"id":"GHSA-p75x-jh7p-ppcx","description":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend","datePublished":"Oct 7, 2026, 4:23:52 PM","dateUpdated":"Oct 7, 2026, 4:23:52 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106505\nhttps://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9\nhttps://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94070\n","aliases":"CVE-2026-106505\nGHSA-p75x-jh7p-ppcx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}