CVE-2026-106505: Backstage plugin-techdocs-node MkDocs config sanitizer bypass

CVE-2026-106505 · Severity: high · CVSS 7.7 · Published 2026-10-06

Backstage is an open-source framework for building developer portals. A flaw in the techdocs-node plugin allows users with repository commit access to bypass the MkDocs configuration file sanitizer and execute arbitrary code on the TechDocs backend server during documentation generation. This could enable attackers to compromise the documentation build infrastructure and gain control of the backend host.

Technologies: Backstage Plugin-Techdocs-Node, @backstage/plugin-techdocs-node (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2026-106505 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106505 being exploited in the wild.
How severe is CVE-2026-106505?
High severity, with a CVSS score of 7.7, published 6 October 2026.
Which products and versions are affected?
Backstage Plugin-Techdocs-Node prior to 1.14.6 and 1.15.4; @backstage/plugin-techdocs-node (npm) < 1.15.4, SEMVER:introduced=0,fixed=1.15.4.
Is there a fix for CVE-2026-106505?
Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106505 attacked?
It is attacked over the network.
Am I affected by CVE-2026-106505?
Check whether you run Backstage Plugin-Techdocs-Node or @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later
    npm install @backstage/plugin-techdocs-node@1.15.4

Technical details

A bypass of the MkDocs configuration sanitizer in the @backstage/plugin-techdocs-node package allows attackers with commit access to a repository to circumvent protections introduced for CVE-2026-25153. By crafting a malicious MkDocs configuration file, an attacker can execute arbitrary code on the TechDocs backend host during the documentation generation stage. The vulnerability requires repository write access and is triggered during the normal documentation build process.

Affected products

  • Backstage plugin-techdocs-node prior to 1.14.6 and 1.15.4

Identifiers

  • CVE-2026-106505
  • GHSA-p75x-jh7p-ppcx

Timeline

  • 2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.