CVE-2026-106558

8.8 HIGHpublic exploit available

Published 2026-10-07 · Updated 2026-10-13

AI risk analysis

Summary: The flaw allows an authenticated attacker to bypass TechDocs sanitization and execute arbitrary code by manipulating the markdown_extensions configuration.
Exploitability: Exploitation requires an authenticated user who can register or influence an SCM-backed documentation source. The attacker must have knowledge of the specific configuration to exploit the vulnerability.
Blast radius: If exploited, the impact is significant as it could lead to arbitrary code execution, especially if the documentation generation runs with backend credentials, filesystem access, or internal network access.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Backstage version 1.14.8, 1.15.6, or 2.0.1.

rceauth-bypasstechdocsbackstagemarkdown

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Vendors

linuxfoundation

Products

backstage plugin-techdocs-node, backstage

Public exploit & PoC references

https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b[Patch]
https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709[Patch]
https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c[Patch]
https://github.com/backstage/backstage/releases/tag/v1.50.7[Patch, Release Notes]
https://github.com/backstage/backstage/releases/tag/v1.54.9[Patch, Release Notes]
https://github.com/backstage/backstage/releases/tag/v1.55.2[Patch, Release Notes]
https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g[Mitigation, Vendor Advisory]

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.