# CVE-2026-106558: Backstage plugin-techdocs-node code execution in MkDocs configuration

Source: https://junglewise.ai/threats/cve-2026-106558-backstage-improper-validation-of-techdocs-mkdocs-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-106558 · Severity: high · CVSS 8.8 · Published 2026-10-07

Backstage's TechDocs plugin, which generates technical documentation from Markdown files, contains a flaw that allows authenticated attackers to execute arbitrary code during documentation generation. An attacker who can control or influence documentation configuration can inject malicious Python code that runs with the privileges of the documentation generator, potentially exposing credentials, accessing files, or compromising internal systems.

Technologies: [Backstage Plugin-Techdocs-Node](https://junglewise.ai/threats/technologies/plugin-techdocs-node), [@backstage/plugin-techdocs-node (npm)](https://junglewise.ai/threats/technologies/npm-backstage-plugin-techdocs-node). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106558 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106558 being exploited in the wild.

**How severe is CVE-2026-106558?** High severity, with a CVSS score of 8.8, published 7 October 2026.

**Which products and versions are affected?** Backstage Plugin-Techdocs-Node < 1.14.8; >= 1.15.0 and < 1.15.6; >= 2.0.0 and < 2.0.1; @backstage/plugin-techdocs-node (npm) < 1.15.4, SEMVER:introduced=0,fixed=1.15.4.

**Is there a fix for CVE-2026-106558?** Yes. @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later. Until then: Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review all changes to documentation configuration before generation runs.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-08-28"},{"kind":"advisory","at":"2026-10-07"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106558 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106558?** Check whether you run Backstage Plugin-Techdocs-Node or @backstage/plugin-techdocs-node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-techdocs-node (npm): upgrade to 1.15.4 or later

  ```sh
  npm install @backstage/plugin-techdocs-node@1.15.4
  ```


Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review all changes to documentation configuration before generation runs.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-08-28"},{"kind":"advisory","at":"2026-10-07"}]

## Technical details

The vulnerability is an unsafe deserialization flaw (CWE-502) in the MkDocs configuration validation: an authenticated attacker can provide a mapping-style markdown_extensions configuration that bypasses TechDocs sanitization and instantiates arbitrary Python objects in the generator runtime. The vulnerability requires low privileges (authentication) and no user interaction, affecting confidentiality, integrity, and availability.

## Affected products

- Backstage plugin-techdocs-node < 1.14.8; >= 1.15.0 and < 1.15.6; >= 2.0.0 and < 2.0.1

## Identifiers

- CVE-2026-106558
- GHSA-qmw3-745m-w99g

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g](https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g)

## Related threats

- [Backstage TechDocs remote code execution via mkdocs.yml](https://junglewise.ai/threats/cve-2026-106510-backstage-remote-code-execution-via-crafted-markdown-extensions)
- [Backstage improper input validation in TechDocs Markdown extension](https://junglewise.ai/threats/cve-2026-106557-backstage-has-improper-input-validation-in-techdocs-markdown)
- [Backstage plugin-techdocs-node code execution in mkdocs configuration](https://junglewise.ai/threats/cve-2026-106509-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage TechDocs local publisher path traversal](https://junglewise.ai/threats/cve-2026-106508-backstage-is-an-open-framework-for-building-developer-portals)
- [Backstage plugin-techdocs-node arbitrary file read in mkdocs snippets](https://junglewise.ai/threats/cve-2026-106507-backstage-is-an-open-framework-for-building-developer-portals)