CVE-2026-25153: @backstage/plugin-techdocs-node Arbitrary Code Execution via MkDocs Hooks
Summary
CVE-2026-25153: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks. Affects @backstage/plugin-techdocs-node across 2 version ranges.
< 1.13.11
>= 1.14.0, < 1.14.1
Fixed in 1.13.11 or 1.14.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs-node package is a plugin for the Backstage platform that enables the generation and serving of documentation using MkDocs. It allows users to create and manage technical documentation efficiently. However, a vulnerability exists that allows malicious actors to exploit MkDocs hooks in the configuration file, potentially leading to arbitrary code execution on the TechDocs build server.
Vulnerability Detail
The vulnerability arises when TechDocs is configured with 'runIn: local'. A malicious actor with access to modify a repository's mkdocs.yml file can inject arbitrary Python code through MkDocs hooks. This can lead to severe security implications, including unauthorized access to the build server and execution of harmful scripts. The issue is exacerbated by the lack of restrictions on configuration keys in the mkdocs.yml file, allowing unsupported keys to be processed.
How To Fix
Latest published version: 2.1.0 as of 23 Oct 2026
npm install @backstage/plugin-techdocs-node@2.1.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.111.13.11npm install @backstage/plugin-techdocs-node@1.13.11 -
>= 1.14.0, < 1.14.11.14.1npm install @backstage/plugin-techdocs-node@1.14.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, consider the following workarounds:
- Use Docker mode with restricted access by configuring TechDocs with 'runIn: docker' instead of 'runIn: local'.
- Restrict repository access to limit who can modify mkdocs.yml files.
- Implement PR review requirements for changes to mkdocs.yml files to catch malicious configurations.
- Downgrade MkDocs to a version below 1.4.0 (e.g., 1.3.1) that does not support hooks.
Conclusion
The vulnerability CVE-2026-25153 in @backstage/plugin-techdocs-node allows for arbitrary code execution via MkDocs hooks when configured to run locally. It is crucial to upgrade to the patched versions or implement workarounds to mitigate the risk of exploitation.
See every vulnerability recorded for @backstage/plugin-techdocs-node →
FAQ
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
MkDocs hooks are configuration options that allow users to execute custom Python code at various points during the documentation build process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Implement the suggested workarounds, such as using Docker mode or restricting access to mkdocs.yml files, until you can upgrade.
Yes, building documentation in CI/CD pipelines using @techdocs/cli does not mitigate this vulnerability, as it relies on the same vulnerable @backstage/plugin-techdocs-node package.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-techdocs-node.
