CVE-2026-88064

Backstage's @backstage/plugin-techdocs-node package, which powers TechDocs documentation generation, insufficiently validates the mkdocs.yml file supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values are passed through to the MkDocs documentation generator, causing unintended code execution during the build. An attacker gains code execution in the context of the TechDocs backend or build container, limited to the files, credentials, network access, and other resources available to that process. Any Backstage deployment running a vulnerable version of the plugin with TechDocs enabled is affected wherever non-fully-trusted users can contribute documentation sources. No public proof-of-concept, KEV listing, or known in-the-wild exploitation has been reported; fixes are available in versions 1.14.6 and 1.15.4.

What to do: Upgrade @backstage/plugin-techdocs-node to 1.14.6 (1.14.x line) or 1.15.4 or later. Until patched, restrict which authenticated users can register or modify TechDocs-enabled catalog entries, and reduce the TechDocs backend/build container's access to files, credentials, and network resources. Audit recently added or modified mkdocs.yml files for unsafe Python YAML tags, unusual markdown_extensions, theme options, or extra_templates values.