CVE-2026-106509

Katalog CVE

CVSS 8.8 · High EPSS 0,37%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada linuxfoundation backstage plugin-techdocs-node, linuxfoundation backstage. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c advisory vendor · mitigasi
• https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb exploit · patch
• https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d exploit · patch
• https://github.com/backstage/backstage/releases/tag/v1.50.5 release notes
• https://github.com/backstage/backstage/releases/tag/v1.54.6 release notes