Résumé
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Détails de l’avis
Impact
An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built.
Patches
Patched in @backstage/plugin-techdocs-node, version 1.15.4.
Workarounds
If you cannot upgrade immediately:
- Switch to
techdocs.builder: externalto isolate TechDocs builds in a container. - Restrict who can register catalog entities with TechDocs annotations.
- Audit existing catalog entities for suspicious
markdown_extensionsvalues in theirmkdocs.ymlfiles.
Références
- https://github.com/advisories/GHSA-4488-j8vj-vqqv
- https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv
- https://nvd.nist.gov/vuln/detail/CVE-2026-106510
- https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb
- https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-96229
Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability
- HIGHCVE-2026-106440
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
- HIGHCVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
- MEDIUMCVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
- HIGHCVE-2026-69088
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
- HIGHCVE-2026-65608
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation