GHSA-928r-fm4v-mvrw
High · 7.7CVSS
7.7
EPSS
—
Published
Mar 5, 2026
CISA due date
—
The record
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @backstage/plugin-techdocs-node | 0 | 1.14.3 |
Related vulnerabilities
- CVE-2026-29186 Backstage is an open framework for building developer portals. Same vulnerability
- GHSA-6jr7-99pf-8vgf @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks Also affects @backstage/plugin-techdocs-node
- GHSA-w669-jj7h-88m9 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local… Also affects @backstage/plugin-techdocs-node
- CVE-2026-25152 Backstage is an open framework for building developer portals, and… Also affects @backstage/plugin-techdocs-node
- CVE-2026-25153 Backstage is an open framework for building developer portals, and… Also affects @backstage/plugin-techdocs-node
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434