Vulnerabilities

Backstage is an open framework for building developer portals.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

7.7

Fix

available

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-106510 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 13
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 5.3 Fix available CVE-2026-106563 Kubernetes
2. 8
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 4.3 Fix available CVE-2026-106562
3. 8
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 5.0 CVE-2026-106561 Kubernetes
4. 20
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 7.1 Fix available CVE-2026-106560 Atlassian
5. 19
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 6.3 Fix available CVE-2026-106559 Atlassian
6. 10
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 8.8 CVE-2026-106558
7. 15
   CVE NVD 24d ago

   Backstage is an open framework for building developer portals.

   CVSS 7.7 Fix available CVE-2026-106556