GHSA-6jr7-99pf-8vgf
High · 7.7CVSS
7.7
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @backstage/plugin-techdocs-node | 0 | 1.13.11 |
| npm | @backstage/plugin-techdocs-node | 1.14.0 | 1.14.1 |
Related vulnerabilities
- CVE-2026-25153 Backstage is an open framework for building developer portals, and… Same vulnerability
- CVE-2026-29186 Backstage is an open framework for building developer portals. Also affects @backstage/plugin-techdocs-node
- GHSA-928r-fm4v-mvrw TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution Also affects @backstage/plugin-techdocs-node
- GHSA-w669-jj7h-88m9 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local… Also affects @backstage/plugin-techdocs-node
- CVE-2026-25152 Backstage is an open framework for building developer portals, and… Also affects @backstage/plugin-techdocs-node
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94