@backstage/plugin-techdocs-node
npm10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @backstage/plugin-techdocs-nodepage 1 of 1
- CVE-2026-106455HIGHCVSS 7.7EG 7.7fixed in 1.14.7 or 1.15.5, by version range2026-10-06
Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticate…
- CVE-2026-106505HIGHCVSS 8.5EG 8.5fixed in 1.15.42026-10-06
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to c…
- CVE-2026-106508MEDIUMCVSS 6.5EG 6.5fixed in 1.15.42026-10-06
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (t…
- CVE-2026-106509HIGHCVSS 8.8EG 8.8fixed in 1.15.42026-10-06
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build …
- CVE-2026-106510HIGHCVSS 7.7EG 7.7fixed in 1.15.42026-10-07
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user …
- CVE-2026-106557HIGHCVSS 7.7EG 7.7fixed in 1.15.42026-10-07
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can r…
- CVE-2026-106558HIGHCVSS 8.8EG 8.8fixed in 1.15.42026-10-07
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker …
- CVE-2026-25152MEDIUMCVSS 6.5EG 6.5fixed in 1.14.1 or 1.13.11, by version range2026-01-30
vulnerable: 1.14.0
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path tra…
- CVE-2026-25153HIGHCVSS 8.8EG 8.8fixed in 1.14.1 or 1.13.11, by version range2026-01-30
vulnerable: 1.14.0
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechD…
- CVE-2026-29186CRITICALCVSS 9.8EG 9.8fixed in 1.14.32026-03-07
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to fi…
Check whether @backstage/plugin-techdocs-node is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @backstage/plugin-techdocs-node CVEs against the assets you own.
Book a Demo →