CVE-2026-106505

npm/@backstage/plugin-techdocs-node CVE-2026-106505: high 7.7, EPSS 0.31%

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Action: Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.

npm i @backstage/plugin-techdocs-node@1.15.4

Affected

Fixed versions

Sources

• osv: GHSA-p75x-jh7p-ppcx
• https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx
• https://nvd.nist.gov/vuln/detail/CVE-2026-106505
• https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9
• https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.50.5
• https://github.com/backstage/backstage/releases/tag/v1.54.6

CVE-2026-106505 · published 2026-10-07T16:23:52Z · modified 2026-10-07T16:30:05.289295195Z · JSON