Summary
Backstage: Improper validation of TechDocs MkDocs configuration
Advisory details
Impact
An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access.
Patches
Patched in @backstage/plugin-techdocs-node version 1.15.4.
Workarounds
Use external TechDocs generation in an isolated environment without sensitive credentials or host access. Restrict and review changes to documentation configuration before generation.
References
- https://github.com/advisories/GHSA-qmw3-745m-w99g
- https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g
- https://nvd.nist.gov/vuln/detail/CVE-2026-106558
- https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b
- https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709
- https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c
- https://github.com/backstage/backstage/releases/tag/v1.50.7
- https://github.com/backstage/backstage/releases/tag/v1.54.9
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-70035
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-87697
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-83520
Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability
- MEDIUMCVE-2026-83557
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
- MEDIUMGHSA-2jx3-ff3v-j7jj
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
- CRITICALCVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py