CVE-2026-88064

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions 1.15.0 through 1.15.4

Description The @backstage/plugin-techdocs-node package insufficiently validates the mkdocs.yml file provided by an authenticated user with permissions to register or modify a TechDocs source. This allows the injection of unsafe Python YAML tags, markdown extensions names and configuration, theme options, and extra templates values into the documentation generator, leading to unintended code execution. The impact is restricted to the files, credentials, network access, and other resources accessible to the TechDocs backend or build container.

Recommendations Update to version 1.14.6. Update to version 1.15.4.