Executive brief
Backstage is an open-source framework for building internal developer portals. The TechDocs plugin, which generates and serves documentation, fails to properly validate configuration files uploaded by authenticated users, allowing injection of malicious Python code through unsafe YAML tags and markdown extension settings. An attacker with documentation edit permissions can execute arbitrary code with the privileges of the backend service or build container.
Technical details
The @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml files supplied by authenticated users who can register or modify a TechDocs source. The vulnerability allows unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values to reach the MkDocs documentation generator, leading to unintended code execution. The attack requires authentication and the ability to register or modify a documentation source. An attacker can exploit this to execute arbitrary code within the permissions context of the TechDocs backend or build container, potentially accessing files, credentials, and network resources available to that service.
Affected products
- Backstage TechDocs before 1.14.6 and 1.15.0 to 1.15.3
Timeline
- 2026-09-16: disclosed
- 2026-08-27: patched: Fixes committed; versions 1.14.6 and 1.15.4 contain patches