High severity · published Oct 7, 2026
CVE-2026-106510
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
7.7
CVSS
0.5%
EPSS
No
On KEV
Description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
backstage · backstage
< 1.50.5; >= 1.51.0-next.0, < 1.54.6 · source: vendor, NVD
PL
plugin-techdocs-node · @backstage
< 1.14.6; >= 1.15.0, < 1.15.4 · source: vendor
BP
Backstage Plugin-techdocs-node · Linuxfoundation
before 1.14.6; 1.15.0 before 1.15.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106510
x_refsource_CONFIRM
https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv
x_refsource_MISC
https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb
x_refsource_MISC
https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.50.5
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.54.6
More from plugin-techdocs-node
8.8
CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
8.8
CVE-2026-106509
Backstage: Improper validation of MkDocs theme configuration in TechDocs
8.5
CVE-2026-106505
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
7.7
CVE-2026-106557
Backstage: Improper input validation in TechDocs Markdown extension configuration
7.7
CVE-2026-106556
Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization