CVE-2026-88064: Backstage TechDocs YAML injection in mkdocs configuration

CVE-2026-88064 · Severity: high · CVSS 8.8 · Published 2026-09-16

Backstage is an open-source framework for building internal developer portals. The TechDocs plugin, which generates and serves documentation, fails to properly validate configuration files uploaded by authenticated users, allowing injection of malicious Python code through unsafe YAML tags and markdown extension settings. An attacker with documentation edit permissions can execute arbitrary code with the privileges of the backend service or build container.

Technologies: Backstage TechDocs. Vendors: Backstage.

Quick answers

Is CVE-2026-88064 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88064 being exploited in the wild.
How severe is CVE-2026-88064?
High severity, with a CVSS score of 8.8, published 16 September 2026.
Which products and versions are affected?
Backstage TechDocs before 1.14.6 and 1.15.0 to 1.15.3.
Is there a fix for CVE-2026-88064?
A patch was published on 2026-08-27: Fixes committed; versions 1.14.6 and 1.15.4 contain patches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88064 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88064?
Check whether you run Backstage TechDocs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml files supplied by authenticated users who can register or modify a TechDocs source. The vulnerability allows unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values to reach the MkDocs documentation generator, leading to unintended code execution. The attack requires authentication and the ability to register or modify a documentation source. An attacker can exploit this to execute arbitrary code within the permissions context of the TechDocs backend or build container, potentially accessing files, credentials, and network resources available to that service.

Affected products

  • Backstage TechDocs before 1.14.6 and 1.15.0 to 1.15.3

Timeline

  • 2026-09-16: disclosed
  • 2026-08-27: patched: Fixes committed; versions 1.14.6 and 1.15.4 contain patches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.