CVE-2026-106510

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.

• CWE-183
• CWE-470

• https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb
• https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d
• https://github.com/backstage/backstage/releases/tag/v1.50.5
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106505Backstage is an open framework for building developer portal…7.7
• CVE-2026-106506Backstage is an open framework for building developer portal…5.3
• CVE-2026-106507Backstage is an open framework for building developer portal…5.3
• CVE-2026-106508Backstage is an open framework for building developer portal…5.3
• CVE-2026-106509Backstage is an open framework for building developer portal…7.7
• CVE-2026-10651bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sd…6.5
• CVE-2026-106511MultiversX's multisig-improved (repository: mx-multisig-and-…9.8
• CVE-2026-106512The CakeResponse::download() method in lib/Cake/Network/Cake…8.4
• CVE-2026-106513MISP exposes critical infrastructure settings—specifically t…6.9
• CVE-2026-10652Zephyr's DNS resolver (subsys/net/lib/dns) parses resource r…7.4
• CVE-2026-10653The Zephyr net_buf library (lib/net_buf/buf.c) manipulated b…8.1
• CVE-2026-10654A race condition in the Zephyr Bluetooth Classic RFCOMM host…3.1