{"action":"Upgrade @backstage/plugin-techdocs-node to 1.13.11 or later.","affected":[{"fixed":"1.14.1","introduced":"1.14.0"},{"fixed":"1.13.11","introduced":"0"}],"component":"@backstage/plugin-techdocs-node","cve_ids":["CVE-2026-25153"],"ecosystem":"npm","epss":0.00606,"exploited":false,"fixed_versions":["1.14.1","1.13.11"],"ghsa_id":"GHSA-6jr7-99pf-8vgf","id":"tcs_01M5KF7CBQ6QKMDTVZF9KHRNMQ","modified_at":"2026-02-03T17:51:32.962569Z","published_at":"2026-02-02T20:19:58Z","references":["https://osv.dev/vulnerability/GHSA-6jr7-99pf-8vgf","https://github.com/backstage/backstage/security/advisories/GHSA-6jr7-99pf-8vgf","https://nvd.nist.gov/vuln/detail/CVE-2026-25153","https://github.com/backstage/backstage"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-6jr7-99pf-8vgf","url":"https://osv.dev/vulnerability/GHSA-6jr7-99pf-8vgf"}],"summary":"@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks"}