CVE-2026-106505 is a high severity flaw (CVSS 7.7) in the Backstage package @backstage/plugin-techdocs-node. Someone who can commit to a repository used by TechDocs can get around the MkDocs configuration sanitizer and run code on the backend host. Fixed in 1.14.6 and 1.15.4.
What's affected
The record says versions before 1.14.6 and 1.15.4 are affected, and that the fix is in 1.14.6 and 1.15.4. The GitHub advisory GHSA-p75x-jh7p-ppcx, published on 28 August 2026 and rated High, lists the npm package @backstage/plugin-techdocs-node with affected versions below 1.14.6 and from 1.15.0 up to but not including 1.15.4. The patched versions are 1.14.6 and 1.15.4. The advisory text also says the patch is in 1.15.4, so take the highest patch in your line.
The record also lists the Backstage repository releases v1.50.5 and v1.54.6, which are the Backstage release lines that carry the package updates. Check which one your deployment follows.
The weaknesses are CWE-426, untrusted search path, and CWE-436, interpretation conflict. The vector needs high attack complexity and low privileges, with a changed scope, which explains why a flaw that gives code execution scores 7.7 and not higher.
How to check if you're exposed
List the installed version in your Backstage app:
yarn why @backstage/plugin-techdocs-node
npm ls @backstage/plugin-techdocs-node
Use the one that matches your package manager. A result below 1.14.6, or from 1.15.0 to 1.15.3, needs action.
Then look at how TechDocs generates documentation. The advisory describes two modes: local, where the backend runs MkDocs directly on its host, and docker, where a container runs it. The advisory's workaround says Docker mode gives isolation but does not fully mitigate the risk. In your app config, check techdocs.generator.runIn.
Finally, list who can commit to repositories registered in your catalog with TechDocs enabled. That group is the set of people who can reach the flaw.
What to do now
- Upgrade @backstage/plugin-techdocs-node to 1.14.6 or 1.15.4, whichever matches your release line, and rebuild the backend.
- If you cannot upgrade today, set
techdocs.generator.runInto docker, as the advisory suggests, and understand that this is not a full mitigation. - Restrict write access to repositories registered in the Backstage catalog to trusted users.
- Move documentation builds into an isolated worker with no access to production secrets, so a build host compromise stays small.
- Review recent changes to mkdocs.yml files in registered repositories for entries you do not recognise.
Why it matters
TechDocs turns Markdown in a repository into a documentation site by running MkDocs. The configuration file for MkDocs is itself code-adjacent: some of its settings can load or run other code. After an earlier CVE, Backstage added a sanitizer to strip such settings. This CVE, according to the record, is a way around that sanitizer, so the earlier protection did not hold.
This is the pattern with blocklist style filters. They keep working until someone finds an input the filter did not think of, and the interpretation of the file by the filter and by the tool that reads it can differ. That mismatch is what CWE-436 names. The deeper fix is isolating the build, because it assumes that repository contributors cannot be fully trusted with the build host.
Backstage backends often hold credentials for source control, cloud accounts and CI. Code execution on that host is worth defending against even when the entry condition is write access to a repository. The record does not flag this CVE as known exploited.
Try it yourself
See how this kind of finding shows up in a dependency workflow.
Click through it at your own pace, or open it full screen.
Quick check
Does Docker mode fix this?
No. The advisory says Docker mode gives container isolation but does not fully mitigate the risk, so upgrade.
Who can exploit this?
The record says users who can commit changes to a repository that uses TechDocs. It is not an anonymous internet attack.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
