Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Advisories.Gitlab • October 8, 2026

An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built.

github.com /advisories/GHSA-4488-j8vj-vqqv

github.com /backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb

github.com /backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d

github.com /backstage/backstage/releases/tag/v1.50.5

github.com /backstage/backstage/releases/tag/v1.54.6

github.com /backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv

nvd.nist.gov /vuln/detail/CVE-2026-106510

Code Behaviors & Features

Detect and mitigate CVE-2026-106510 with GitLab Dependency Scanning

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerability in Backstage TechDocs A remote code execution vulnerability (CVE-2026-106510) has been identified in the Backstage TechDocs framework, affecting versions prior to 1.14.6. Authenticated users with permission to register catalog entities can exploit this flaw by providing a crafted mkdocs.yml file, leading to arbitrary OS command execution on the TechDocs build host during documentation builds. The vulnerability was published on October 7, 2026, with a CVSS score of 7.7, categorizing it as high severity. The issue has been patched in versions 1.14.6 and 1.15.4. Users are advised to upgrade immediately or implement compensating controls such as isolating TechDocs builds in a container and auditing existing catalog entities for suspicious markdown extensions. The vulnerability primarily impacts organizations using Backstage for developer portals. 2 sources 63

Extracted Entities

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (4)