EUVD-2026-94369
GHSA-4488-j8vj-vqqv
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Authenticated entity registration gives PR:L over the network (AV:N); loading the extension reliably runs the command (AC:L), yielding full build-host RCE (C/I/A:H) beyond the plugin's scope (S:C).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
AnalysisAI
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated user holding the privilege to register/update catalog entities in Backstage, plus a TechDocs deployment that builds docs on a host using the mkdocs generator (local or docker build strategy). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a CVSS-inflated one, but it is bounded by an authentication requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: upgrade @backstage/plugin-techdocs-node to 1.14.6 (or 1.15.4 for the 1.15 line), or move the whole Backstage platform to a release that contains it, such as v1.50.5 (https://github.com/backstage/backstage/releases/tag/v1.50.5) or v1.54.6 (https://github.com/backstage/backstage/releases/tag/v1.54.6); the vendor advisory (https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv) and the upstream sanitization commits (https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb and https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d) document the corrected MkDocs configuration scrubbing, which now strips dangerous nested markdown_extensions and theme options. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Backstage deployment using the @backstage/plugin-techdocs-node mkdocs generator, confirm the installed version, and upgrade to the vendor-released fixed versions 1.14.6 (1.14.x line) or 1.15.4 (1.15.x line) as applicable; where upgrades cannot be completed immediately, pause TechDocs builds or restrict catalog entity registration and update permissions to a small, trusted group. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Same weakness CWE-183 – Permissive List of Allowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today