CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-13
Weakness: CWE-183

Description

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

Affected products

backstage: before 1.50.5; from 1.51.1 before 1.54.6; 1.51.0, 1.51.0-next0, 1.51.0-next1, 1.51.0-next2, 1.51.0-next3 — fixed in 1.50.5, 1.54.6
Linuxfoundation Backstage Plugin-Techdocs-Node: before 1.14.6; from 1.15.0 before 1.15.4 — fixed in 1.14.6, 1.15.4

How to fix

Upgrade to a fixed version: backstage 1.50.5, 1.54.6; Linuxfoundation Backstage Plugin-Techdocs-Node 1.14.6, 1.15.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106510 or the next vulnerability affects your stack