{"id":"EUVD-2026-94074","enisaUuid":"1cc10bd0-c1d0-33a7-bb43-72bbdba15d3e","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.","datePublished":"Oct 6, 2026, 9:50:07 PM","dateUpdated":"Oct 7, 2026, 6:01:48 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106509\nGHSA-8w7q-29mw-gf5c\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"28bac6e0-b217-34ac-8c4f-c3d7196f288a","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"74ef2121-465e-3370-a762-16714097aede","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"},{"id":"7bd6645f-c1a2-333b-82f8-a5dd4e969d27","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"a0ff5749-4632-3111-9a9a-5aad02808f9f","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"}],"enisaIdVendor":[{"id":"001763db-d8d8-39bb-8eff-76d14ea704d8","vendor":{"name":"@backstage"}},{"id":"307b5e28-abd7-3e05-ab59-3eb42137b825","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"dd2591dd-0f3a-37a1-a797-6e7fe1133925","vulnerability":{"id":"GHSA-8w7q-29mw-gf5c","description":"Backstage: Improper validation of MkDocs theme configuration in TechDocs","datePublished":"Oct 7, 2026, 4:23:30 PM","dateUpdated":"Oct 7, 2026, 4:23:30 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106509\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94074\n","aliases":"CVE-2026-106509\nGHSA-8w7q-29mw-gf5c\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ed7c5e93-9e65-37f9-af02-e81edbed56ab","vulnerability":{"id":"CVE-2026-106509","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.","datePublished":"Oct 6, 2026, 9:50:07 PM","dateUpdated":"Oct 7, 2026, 6:01:48 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94074\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"1a56e350-f709-37a7-9af7-7c745d98e0f8","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"7ab1f705-2917-38e3-9c55-8120748d5b29","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"},{"id":"b224093e-b8cd-39e1-a902-56792d4d0e21","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"e239e620-f7fa-3e02-982b-9be3299785e1","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"}],"vulnerabilityVendor":[{"id":"11ccf8ad-fe96-3886-9efe-fdf2829ee31f","vendor":{"name":"backstage"}},{"id":"bf0a5cb4-a993-3314-b5e9-68b62f637aa1","vendor":{"name":"@backstage"}}]}}],"enisaIdAdvisory":[]}