CVE-2026-106510 in Backstage
Summary
by MITRE • 10/07/2026
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as CVE-2023-48795 represents a critical remote code execution flaw within Backstage, specifically affecting the @backstage/plugin-techdocs-node package prior to versions 1.14.6 and 1.15.4. This security issue stems from an improper neutralization of special elements used in markup or commands, commonly categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command. The core technical flaw lies in the processing of configuration files for MkDocs, specifically the mkdocs.yml file which is utilized to define documentation structure and build parameters. When a user registers catalog entities within Backstage, they can supply custom metadata including this configuration file. If the system processes these configurations without adequate sanitization or validation of embedded commands, it allows an attacker to inject malicious content into the markdown extensions section.
The operational impact of this vulnerability is severe due to its potential for arbitrary operating system command execution on the TechDocs build host. An authenticated user with the ability to register catalog entities can craft a specific mkdocs.yml file that exploits the parsing logic within the techdocs plugin. When the documentation build process is triggered, typically via automated pipelines or manual triggers initiated by other users or systems, the backend service interprets the crafted input as executable commands rather than static configuration data. This results in the execution of arbitrary code with the privileges of the user account running the TechDocs builder service. Such access can lead to complete compromise of the underlying infrastructure, including data exfiltration, lateral movement within the network, and potential disruption of development workflows by altering or destroying critical documentation assets.
This attack vector aligns closely with ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly those involving OS command injection through application inputs. The vulnerability highlights a significant risk in developer portal environments where ease of use for registering new services often comes at the cost of rigorous input validation on configuration files that are subsequently processed by backend systems. Attackers can leverage this flaw not only to execute commands but potentially to establish persistent access if they can modify system configurations or install backdoors during the command execution phase. The severity is further amplified in environments where the TechDocs service runs with elevated privileges, such as root or administrator rights, which are common in containerized build agents to ensure proper file permissions and package installations.
Mitigation strategies primarily involve upgrading the Backstage installation to version 1.14.6 or later, where this issue has been resolved through improved input validation and sanitization of configuration files processed by the techdocs plugin. For organizations unable to immediately upgrade, it is crucial to restrict who can register catalog entities with custom metadata that influences build configurations. Implementing strict access controls ensures that only trusted administrators can modify critical service definitions. Additionally, running the TechDocs builder in a restricted environment with minimal privileges and using container isolation techniques like Kubernetes Pod Security Policies or SELinux contexts can limit the blast radius of any successful exploitation attempt. Regular auditing of registered entities and their associated configurations also aids in detecting anomalous activities that may indicate an attempted exploit before it leads to full system compromise.