CVE-2026-106505: Linuxfoundation Backstage

High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.

Affected products

• Linuxfoundation Backstage: before 1.50.5 (fixed in 1.50.5); from 1.51.1, before 1.54.6 (fixed in 1.54.6); version 1.51.0 only
• Linuxfoundation Backstage Plugin-Techdocs-Node: before 1.14.6 (fixed in 1.14.6); from 1.15.0, before 1.15.4 (fixed in 1.15.4)

Published 2026-10-06. Last modified 2026-10-09.