EUVD-2026-94370Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Authenticated docs-source writer (PR:L) sends payload over the network (AV:N); crafting a sanitizer-bypassing YAML tag is non-trivial (AC:H); code runs in a separate build container (S:C) with impact bounded to that environment (C:H/I:L/A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
AnalysisAI
Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Backstage user who holds permission to register a new TechDocs documentation source or modify an existing one (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a legitimate but conditional risk rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @backstage/plugin-techdocs-node to 1.14.6 or 1.15.4 (vendor-released patch); the corresponding Backstage framework releases are v1.50.5 and v1.54.6, so rebuilding against those release lines also resolves the issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Backstage deployments and identify the exact @backstage/plugin-techdocs-node version in use, and determine whether TechDocs generation is configured for local or Docker-based builds (exposed) versus externally pre-built documentation (not exposed); simultaneously tighten catalog write permissions so only trusted maintainers can register or modify documentation sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today