Plugin techdocs node: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml (CVE-2026-106510)

CVE-2026-106510 is a remote code execution vulnerability in the @backstage/plugin-techdocs-node package. It arises when an authenticated user capable of registering catalog entities supplies a malicious mkdocs.yml file with crafted markdown_extensions. This causes arbitrary operating system command execution on the host building TechDocs documentation. The vulnerability is fixed in version 1.15.4 of the plugin. Until upgrading, mitigations include using an external build container, limiting entity registration permissions, and auditing existing configurations for suspicious markdown_extensions values.

An attacker with authenticated access and catalog entity registration rights can execute arbitrary OS commands on the TechDocs build host. This can lead to full compromise of the build environment, potentially affecting confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 7.7 (high severity), reflecting network attack vector, high privileges required, and significant impact on confidentiality, integrity, and availability.

Upgrade @backstage/plugin-techdocs-node to version 1.15.4 or later to apply the official patch. If immediate upgrade is not possible, switch the TechDocs builder configuration to 'external' to isolate builds in a container environment. Additionally, restrict permissions to register catalog entities with TechDocs annotations to trusted users only. Audit existing catalog entities for suspicious markdown_extensions entries in their mkdocs.yml files and remediate as necessary.