CVE-2026-106509: Backstage: Improper validation of MkDocs theme configuration in TechDocs

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-10-06 · updated 2026-10-09
Weakness: CWE-94

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.

Affected products

backstage: before 1.50.5; from 1.51.1 before 1.54.6; 1.51.0, 1.51.0-next0, 1.51.0-next1, 1.51.0-next2, 1.51.0-next3 — fixed in 1.50.5, 1.54.6
Linuxfoundation Backstage Plugin-Techdocs-Node: before 1.14.6; from 1.15.0 before 1.15.4 — fixed in 1.14.6, 1.15.4

How to fix

Upgrade to a fixed version: backstage 1.50.5, 1.54.6; Linuxfoundation Backstage Plugin-Techdocs-Node 1.14.6, 1.15.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106509 or the next vulnerability affects your stack