CVSS 8.5 · High EPSS 0,31%
Kerentanan Untrusted Search Path pada linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage. Skor CVSS 3.1 8.5 (High) menurut NVD.
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linuxfoundation | backstage plugin-techdocs-node | Semua versi sebelum 1.14.6 |
| linuxfoundation | backstage plugin-techdocs-node | Versi 1.15.0 hingga sebelum 1.15.4 |
| linuxfoundation | backstage | Semua versi sebelum 1.50.5 |
| linuxfoundation | backstage | Versi 1.51.1 hingga sebelum 1.54.6 |
| linuxfoundation | backstage | Versi 1.51.0 |
| linuxfoundation | backstage | Versi 1.51.0 next0 |
| linuxfoundation | backstage | Versi 1.51.0 next1 |
| linuxfoundation | backstage | Versi 1.51.0 next2 |
| linuxfoundation | backstage | Versi 1.51.0 next3 |