CyberRota Analysis
AI-GeneratedThe @backstage/plugin-techdocs-node package prior to version 1.14.6 is vulnerable due to a configuration bypass in the sanitization of mkdocs.yml, allowing authenticated users to execute arbitrary commands in the build environment. This could lead to unauthorized access to resources within the TechDocs backend or build container. Organizations using Backstage for developer portals should prioritize upgrading to versions 1.14.6 or 1.15.4 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)