CVE-2026-106505 Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Attackers with repository commit access can bypass sanitizers to execute arbitrary code on the TechDocs backend host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106505?
CVE-2026-106505 is a high-severity code injection vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
Which versions are affected by CVE-2026-106505?
2 open source packages ship an affected version, including @backstage/plugin-techdocs-node. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-techdocs-node npm | All versions | 1.15.4 |
@backstage/plugin-techdocs-node npm | All versions | 1.15.4 |
Products include Linuxfoundation Backstage, Linuxfoundation Backstage Plugin-Techdocs-Node.
How do I fix CVE-2026-106505?
Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-106505 being exploited?
There is no known exploitation of CVE-2026-106505 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-p75x-jh7p-ppcx.