{"id":"EUVD-2026-94369","enisaUuid":"e6501d2f-82b1-330f-9b14-1a0bdce6c5bb","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.","datePublished":"Oct 7, 2026, 2:36:53 PM","dateUpdated":"Oct 7, 2026, 5:15:43 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106510\nGHSA-4488-j8vj-vqqv\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"47907b7e-ea0c-3f1c-89cb-4b2092eacc40","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"7fe542de-b633-355c-a21e-a6c9df2fa48f","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"},{"id":"8a00f1b9-d6f7-30d4-a13b-1cb1839e72dd","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"},{"id":"ce96b63d-e3be-3138-bbbf-c59473e0218b","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"}],"enisaIdVendor":[{"id":"2e27255d-1caf-3716-b62d-09634a6aa10a","vendor":{"name":"backstage"}},{"id":"d66fff5c-69b8-3d7b-a3fb-2a721c38acad","vendor":{"name":"@backstage"}}],"enisaIdVulnerability":[{"id":"37c89681-ec17-3baa-8cbd-60a0cd7e1bd7","vulnerability":{"id":"CVE-2026-106510","description":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.","datePublished":"Oct 7, 2026, 2:36:53 PM","dateUpdated":"Oct 7, 2026, 5:15:43 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94369\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 1, 2026, 4:04:28 AM","vulnerabilityProduct":[{"id":"70f3c814-ba53-305a-a565-116d876aaaad","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.50.5"},{"id":"98fc4aa6-fb7c-357b-bed0-5fdfc5931799","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.51.0-next.0, \u003c 1.54.6"},{"id":"a60c8a7d-c872-3c92-b3b5-6a03e63f41f1","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"1.15.0, \u003c 1.15.4"},{"id":"c0adbdcb-cbf5-31fb-b5ad-38ca6ae367f9","product":{"name":"plugin-techdocs-node","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.14.6"}],"vulnerabilityVendor":[{"id":"3c161f06-3671-3a7c-991e-37b6dd97dcdd","vendor":{"name":"@backstage"}},{"id":"f8541ebb-afe4-3765-aa4b-0fe981b68465","vendor":{"name":"backstage"}}]}},{"id":"8e9abefc-cce2-31ce-bbc4-f85cf66547c0","vulnerability":{"id":"GHSA-4488-j8vj-vqqv","description":"Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml","datePublished":"Oct 7, 2026, 6:03:22 PM","dateUpdated":"Oct 7, 2026, 6:03:22 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106510\nhttps://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb\nhttps://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.50.5\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94369\n","aliases":"CVE-2026-106510\nGHSA-4488-j8vj-vqqv\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}