Plugin Techdocs Node
Monthly
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-techdocs-node) lets an authenticated user who can register or modify documentation sources make a TechDocs build read files or fetch URLs outside the documentation boundary, potentially exposing backend-host data or internal network resources (path traversal, CWE-22). Affected versions are those before 1.14.6 on the 1.14 line and before 1.15.4 on the 1.15 line; the impact is changed-scope with high confidentiality loss and no integrity or availability impact, and it applies to deployments where the Backstage backend generates TechDocs from those sources rather than relying on externally sandboxed CI. Exploitation requires an authenticated principal with documentation-source registration or modification rights (PR:L), and no public exploit code has been identified at time of analysis; this is assessed as a credible, patch-worthy issue rather than an emergency, with vendor fixes released in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4 plus pymdown-extensions 10.21.3 or newer.
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer portal framework allows a user who can register or influence an SCM-backed documentation source to execute arbitrary code on the TechDocs backend host. The flaw (CWE-502, CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) arises because mapping-style markdown_extensions entries in a committed mkdocs.yml were not sanitized, letting an attacker name Python callables such as subprocess:Popen or os:system that MkDocs then imports and instantiates during documentation generation. Exploitation requires a valid account and an instance that performs server-side TechDocs generation of attacker-controlled sources, so risk is highest where generation runs with backend credentials, filesystem access, or internal network reachability; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. The issue is fixed in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4, is rated CVSS 7.7 with high attack complexity, low privileges, and scope change, and there is no public exploit identified at time of analysis.
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. Vendor-released patches exist in @backstage/plugin-techdocs-node 1.14.7 and 1.15.5 (and in Backstage releases v1.50.6, v1.54.8, v1.55.0); no public exploit identified at time of analysis.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-techdocs-node) lets an authenticated user who can register or modify documentation sources make a TechDocs build read files or fetch URLs outside the documentation boundary, potentially exposing backend-host data or internal network resources (path traversal, CWE-22). Affected versions are those before 1.14.6 on the 1.14 line and before 1.15.4 on the 1.15 line; the impact is changed-scope with high confidentiality loss and no integrity or availability impact, and it applies to deployments where the Backstage backend generates TechDocs from those sources rather than relying on externally sandboxed CI. Exploitation requires an authenticated principal with documentation-source registration or modification rights (PR:L), and no public exploit code has been identified at time of analysis; this is assessed as a credible, patch-worthy issue rather than an emergency, with vendor fixes released in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4 plus pymdown-extensions 10.21.3 or newer.
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer portal framework allows a user who can register or influence an SCM-backed documentation source to execute arbitrary code on the TechDocs backend host. The flaw (CWE-502, CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) arises because mapping-style markdown_extensions entries in a committed mkdocs.yml were not sanitized, letting an attacker name Python callables such as subprocess:Popen or os:system that MkDocs then imports and instantiates during documentation generation. Exploitation requires a valid account and an instance that performs server-side TechDocs generation of attacker-controlled sources, so risk is highest where generation runs with backend credentials, filesystem access, or internal network reachability; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. The issue is fixed in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4, is rated CVSS 7.7 with high attack complexity, low privileges, and scope change, and there is no public exploit identified at time of analysis.
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. Vendor-released patches exist in @backstage/plugin-techdocs-node 1.14.7 and 1.15.5 (and in Backstage releases v1.50.6, v1.54.8, v1.55.0); no public exploit identified at time of analysis.