Backstage
Monthly
Arbitrary code execution in Backstage @backstage/plugin-techdocs-node versions before 1.13.11 and 1.14.1 allows authenticated users with repository access to execute malicious Python code on TechDocs build servers by injecting MkDocs hook configurations into mkdocs.yml files. The vulnerability affects deployments using the `runIn: local` configuration option, where an attacker can leverage the hooks feature to achieve remote code execution during documentation builds. Fixed versions implement an allowlist of permitted MkDocs configuration keys and strip unsupported keys including hooks before processing.
Backstage TechDocs plugin versions prior to 1.13.11 and 1.14.1 contain a path traversal vulnerability that allows authenticated attackers to read arbitrary files from the host filesystem when the local generator is enabled. The vulnerability stems from insufficient symlink validation during the documentation build process, enabling attackers to embed sensitive file contents into generated HTML accessible to documentation viewers. Organizations using `techdocs.generator.runIn: local` with untrusted documentation sources are at risk until patching to the fixed versions.
Arbitrary code execution in Backstage @backstage/plugin-techdocs-node versions before 1.13.11 and 1.14.1 allows authenticated users with repository access to execute malicious Python code on TechDocs build servers by injecting MkDocs hook configurations into mkdocs.yml files. The vulnerability affects deployments using the `runIn: local` configuration option, where an attacker can leverage the hooks feature to achieve remote code execution during documentation builds. Fixed versions implement an allowlist of permitted MkDocs configuration keys and strip unsupported keys including hooks before processing.
Backstage TechDocs plugin versions prior to 1.13.11 and 1.14.1 contain a path traversal vulnerability that allows authenticated attackers to read arbitrary files from the host filesystem when the local generator is enabled. The vulnerability stems from insufficient symlink validation during the documentation build process, enabling attackers to embed sensitive file contents into generated HTML accessible to documentation viewers. Organizations using `techdocs.generator.runIn: local` with untrusted documentation sources are at risk until patching to the fixed versions.