CVE-2026-106510

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions prior to 1.15.4

Description The @backstage/plugin-techdocs-node package allows remote code execution through crafted markdown extensions within the mkdocs.yml file. An authenticated user with permissions to register catalog entities can provide a malicious mkdocs.yml file, leading to arbitrary OS command execution on the TechDocs build host during the documentation build process.

Recommendations Update to version 1.14.6. Update to version 1.15.4. Switch to techdocs.builder: external to isolate TechDocs builds in a container. Restrict permissions for users who can register catalog entities with TechDocs annotations. Audit existing catalog entities for suspicious markdown extensions values in their mkdocs.yml files.