CVE-2026-106510: @backstage Plugin-Techdocs-Node

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

Affected products

• @backstage Plugin-Techdocs-Node: before 1.14.6 (fixed in 1.14.6); from 1.15.0, before 1.15.4 (fixed in 1.15.4)
• Backstage Backstage: before 1.50.5 (fixed in 1.50.5); from 1.51.0-next.0, before 1.54.6 (fixed in 1.54.6)

Published 2026-10-07. Last modified 2026-10-07.