CVE-2026-106510: Remote Code Execution in @backstage/plugin-techdocs-node via Crafted mkdocs.yml
Summary
CVE-2026-106510: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml. Affects @backstage/plugin-techdocs-node versions < 1.15.4. Fixed in 1.15.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs-node package is a component of Backstage, an open platform for building developer portals. It enables users to create and manage documentation using TechDocs, which relies on Markdown files and configuration through mkdocs.yml. This package is designed to facilitate documentation generation and hosting, making it easier for teams to maintain and share their technical documentation. However, it is vulnerable to a remote code execution flaw that arises when an authenticated user can manipulate the mkdocs.yml file.
Vulnerability Detail
The vulnerability allows an authenticated user who can register catalog entities to provide a crafted mkdocs.yml file. This crafted file can lead to arbitrary OS command execution on the TechDocs build host during the documentation build process. The issue stems from improper handling of markdown_extensions, which can be exploited to execute malicious commands, potentially compromising the host system.
How To Fix
Latest published version: 2.1.0 as of 23 Oct 2026
npm install @backstage/plugin-techdocs-node@2.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.4
This is the first release that contains the fix.
npm install @backstage/plugin-techdocs-node@1.15.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider the following workarounds: 1. Switch to techdocs.builder: external to isolate TechDocs builds in a container. 2. Restrict who can register catalog entities with TechDocs annotations. 3. Audit existing catalog entities for suspicious markdown_extensions values in their mkdocs.yml files.
Conclusion
The CVE-2026-106510 vulnerability in the @backstage/plugin-techdocs-node package poses a significant risk due to its potential for remote code execution. Users are advised to update to the patched version or implement the suggested workarounds to mitigate the risk. Regular audits and monitoring of dependencies are crucial for maintaining security.
See every vulnerability recorded for @backstage/plugin-techdocs-node →
FAQ
CVE-2026-106510 is a vulnerability in the @backstage/plugin-techdocs-node package that allows remote code execution via crafted mkdocs.yml files.
Any authenticated user who can register catalog entities in Backstage is potentially affected by this vulnerability.
Exploitation of this vulnerability can lead to arbitrary OS command execution on the TechDocs build host, which may compromise the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-techdocs-node.
