Threats Tagged 'ghsa-q38j-6vcm-2f5m'

An authenticated attacker with control over a TechDocs source repository in the Backstage plugin techdocs node can cause a documentation build to retrieve and publish data from network locations accessible by the build environment. The exposure depends on deployment topology, build mode, and endpoint protections. The vulnerability is addressed by upgrading to patched versions that remove MkDocs plugins outside a built-in allowlist. Additional mitigations include restricting repository control and limiting network access during builds.