Junglewise Threat Intelligence

CVE-2026-25153: Backstage TechDocs code execution via MkDocs hooks configuration

CVE-2026-25153 · Severity: high · CVSS 7.7 · Published 2026-01-30

Technologies: Red Hat Developer Hub. Vendors: Backstage, Red Hat.

Executive brief

Backstage is an open-source framework used by organizations to build internal developer portals. A vulnerability in its TechDocs component allows an attacker who can modify a project's documentation configuration file to execute malicious code on the server responsible for building the documentation. This could lead to unauthorized access to sensitive data or a compromise of the build environment.

Technical details

A code injection vulnerability exists in @backstage/plugin-techdocs-node when the 'runIn: local' configuration is used. The root cause is the improper sanitization of the mkdocs.yml configuration file, which allows the 'hooks' feature of MkDocs (introduced in version 1.4.0) to execute arbitrary Python scripts during the documentation generation process. An attacker with low privileges (sufficient to submit a Pull Request or modify a repository) can trigger this execution on the TechDocs build server. The vulnerability is addressed in versions 1.13.11 and 1.14.1 by implementing an allowlist that strips unsupported keys, including 'hooks', from the configuration file before processing.

Affected products

  • Backstage @backstage/plugin-techdocs-node < 1.13.11, = 1.14.0
  • Red Hat Red Hat Developer Hub 1.8, 1.9
  • Backstage @techdocs/cli All versions using vulnerable plugin-techdocs-node

Timeline

  • 2026-01-30: advisory: Initial disclosure by Backstage maintainers
  • 2026-01-30: patched: Fix released in versions 1.13.11 and 1.14.1
  • 2026-03-30: patched: Red Hat released RHSA-2026:6174 for Developer Hub 1.8.5

References

Related threats