CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration

High 8.8 Published 16 Sep 2026 Updated 16 Sep 2026

Authenticated users can execute arbitrary code via unsafe YAML tags in TechDocs configuration, impacting the backend container resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-88064?

CVE-2026-88064 is a high-severity code injection vulnerability in Linuxfoundation Backstage, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the documentation generator and cause unintended code execution. The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.

Weakness: CWE-20, CWE-1336

Which versions are affected by CVE-2026-88064?

It affects 2 products.

Products include Linuxfoundation Backstage, Linuxfoundation Backstage Plugin-Techdocs-Node.

How do I fix CVE-2026-88064?

No fix has been published for CVE-2026-88064 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-88064 being exploited?

There is no known exploitation of CVE-2026-88064 in the wild and no public exploit code.

All Linuxfoundation Backstage vulnerabilities

Sources

Also known as GHSA-292q-8mf5-h6g3.