CVE-2026-106509: Linuxfoundation Backstage

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.

Affected products

• Linuxfoundation Backstage: before 1.50.5 (fixed in 1.50.5); from 1.51.1, before 1.54.6 (fixed in 1.54.6); version 1.51.0 only
• Linuxfoundation Backstage Plugin-Techdocs-Node: before 1.14.6 (fixed in 1.14.6); from 1.15.0, before 1.15.4 (fixed in 1.15.4)

Published 2026-10-06. Last modified 2026-10-09.