Backstage TechDocs CVE-2026-25153

Requires TechDocs to be configured with runIn: local (local generation mode rather than the more isolated runIn: docker), and an installed MkDocs version >= 1.4.0 that supports the hooks configuration key. The attacker must be able to submit or modify the mkdocs.yml file in a repository that TechDocs processes - i.e., write access or an accepted pull request/fork contribution (matching CVSS PR:L). No end-user interaction is needed; execution triggers automatically on the next documentation build. Limiting factors: it does not work against runIn: docker deployments without escaping the container, it is neutralized by MkDocs < 1.4.0, and it is fully blocked once the package is patched (the allowlist strips hooks). Building via @techdocs/cli in CI/CD does NOT limit exploitation - the CLI uses the same vulnerable package.

Signals are mixed but coherent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity attack requiring only low privileges (a repository contributor) and no user interaction, yielding full confidentiality/integrity/availability impact on the build server - consistent with the description. The EPSS score is very low (0.02%, 6th percentile) and the CVE is NOT in CISA KEV, with no public exploit identified, indicating no observed mass exploitation. This is best read as a real but conditional risk: it is gated on the non-default-sensitive runIn: local configuration and on the attacker having write/PR access to a processed repository, so it favors insider or supply-chain-style abuse over opportunistic internet-wide scanning. The low EPSS does not contradict the high CVSS - it reflects narrow preconditions and absence of weaponized exploit code, not low impact. No SSVC decision data was provided in the input.

An attacker with contributor or fork-PR access to a repository that Backstage TechDocs builds adds a hooks entry to mkdocs.yml pointing at a Python module containing a reverse shell or credential-stealing code. When TechDocs (configured with runIn: local) or a @techdocs/cli CI job builds the documentation, MkDocs loads and executes the hook, running the attacker's Python on the build server. No public exploit code is identified at time of analysis, but the technique is straightforward given MkDocs' documented hooks behavior.