Plugin techdocs node: Backstage: Improper validation of TechDocs MkDocs configuration (CVE-2026-106558)
Description
A vulnerability in the @backstage/plugin-techdocs-node package allows an attacker who can supply configuration to a TechDocs build to execute code in the generator runtime. This risk is especially severe if the documentation generation process runs with backend credentials or has host access. The issue is fixed in version 1.15.4. Until patched, it is recommended to generate TechDocs externally in isolated environments without sensitive credentials and to restrict and review configuration changes before generation.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-106558 describes an improper validation vulnerability in the TechDocs MkDocs configuration within the @backstage/plugin-techdocs-node package. An attacker able to influence the TechDocs build configuration can execute arbitrary code during the documentation generation runtime. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The highest impact occurs when the generation process has elevated privileges or host access. The issue is patched in version 1.15.4 of the plugin.
Potential Impact
Successful exploitation allows code execution in the TechDocs generator runtime, potentially leading to full compromise of the host or backend systems if the process runs with elevated credentials or host access. This can result in complete confidentiality, integrity, and availability loss of affected systems.
Mitigation Recommendations
A patch is available in @backstage/plugin-techdocs-node version 1.15.4 and should be applied promptly. As a workaround, generate TechDocs externally in isolated environments without sensitive credentials or host access. Additionally, restrict and carefully review any changes to the documentation configuration before generation to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qmw3-745m-w99g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-106558"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ac6bffe2cdf04f6568291a0
Added to database: 10/07/2026, 21:56:14 UTC
Last enriched: 10/07/2026, 22:13:31 UTC
Last updated: 10/07/2026, 22:13:31 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.