Arbitrary Code Execution Vulnerability in Backstage's Plugin TechDocs-Node
CVE-2026-106558
What is CVE-2026-106558?
The Backstage TechDocs-Node plugin has a vulnerability that allows an authenticated user to bypass sanitization processes when mapping-style markdown_extensions are improperly validated. This situation can lead to the import and instantiation of arbitrary Python objects during documentation generation. The risk escalates particularly when the documentation generation function is executed with backend credentials, filesystem, or internal network access, potentially resulting in significant security breaches. It is crucial for users of the affected versions to update to 1.14.8, 1.15.6, or 2.0.1 to remediate this issue.
Affected Version(s)
backstage < 1.50.7 < 1.50.7
backstage >= 1.51.0-next.0, < 1.54.9 < 1.51.0-next.0, 1.54.9
backstage >= 1.55.0-next.0, < 1.55.2 < 1.55.0-next.0, 1.55.2