https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:53:27 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-106509 <p>Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.</p> <p>Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-106509 https://vulnerability.circl.lu/vuln/ghsa-8w7q-29mw-gf5c <p><strong>Affected:</strong> npm: @backstage/plugin-techdocs-node</p> <p>### Impact</p> <p>When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in `mkdocs.yml` that cause arbitrary code execution during the documentation build process.</p> <p>### Patches</p> <p>Patched in `@backstage/plugin-techdocs-node` version `1.15.4`</p> <p>### Workarounds</p> <p>- Configure TechDocs with `techdocs.generator.runIn: &#39;docker&#39;` instead of `&#39;local&#39;` to provide container isolation, though this does not fully mitigate the risk. - Restrict write access to repositories registered in the Backstage catalog to trusted users.</p> <p><strong>Affected:</strong> npm: @backstage/plugin-techdocs-node</p> <p>### Impact</p> <p>When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in `mkdocs.yml` that cause arbitrary code execution during the documentation build process.</p> <p>### Patches</p> <p>Patched in `@backstage/plugin-techdocs-node` version `1.15.4`</p> <p>### Workarounds</p> <p>- Configure TechDocs with `techdocs.generator.runIn: &#39;docker&#39;` instead of `&#39;local&#39;` to provide container isolation, though this does not fully mitigate the risk. - Restrict write access to repositories registered in the Backstage catalog to trusted users.</p> https://vulnerability.circl.lu/vuln/ghsa-8w7q-29mw-gf5c