{"action":"Upgrade @backstage/plugin-techdocs-node to 1.15.4 or later.","affected":[{"fixed":"1.15.4","introduced":"0"}],"component":"@backstage/plugin-techdocs-node","cve_ids":["CVE-2026-106505"],"ecosystem":"npm","epss":0.00312,"exploited":false,"fixed_versions":["1.15.4"],"ghsa_id":"GHSA-p75x-jh7p-ppcx","id":"tcs_01M5KG2VZW5QW177VTCA3S036R","modified_at":"2026-10-07T16:30:05.289295195Z","published_at":"2026-10-07T16:23:52Z","references":["https://osv.dev/vulnerability/GHSA-p75x-jh7p-ppcx","https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx","https://nvd.nist.gov/vuln/detail/CVE-2026-106505","https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9","https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.50.5","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-p75x-jh7p-ppcx","url":"https://osv.dev/vulnerability/GHSA-p75x-jh7p-ppcx"}],"summary":"Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend"}