CVE-2026-25153
- Source
- https://cve.org/CVERecord?id=CVE-2026-25153
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25153.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-25153
- Aliases
- Published
- 2026-01-30T21:31:58.870Z
- Modified
- 2026-02-02T19:50:05.448790Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L CVSS Calculator
- Summary
- @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
- Details
-
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with
runIn: local, a malicious actor who can submit or modify a repository'smkdocs.ymlfile can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. @backstage/plugin-techdocs-node versions 1.13.11 and 1.14.1 contain a fix. The fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (includinghooks) are now removed frommkdocs.ymlbefore running the generator, with a warning logged to indicate which keys were removed. Users of@techdocs/clishould also upgrade to the latest version, which includes the fixed@backstage/plugin-techdocs-nodedependency. Some workarounds are available. Configure TechDocs withrunIn: dockerinstead ofrunIn: localto provide container isolation, though it does not fully mitigate the risk. Limit who can modifymkdocs.ymlfiles in repositories that TechDocs processes; only allow trusted contributors. Implement PR review requirements for changes tomkdocs.ymlfiles to detect malicioushooksconfigurations before they are merged. Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features. Building documentation in CI/CD pipelines using@techdocs/clidoes not mitigate this vulnerability, as the CLI uses the same vulnerable@backstage/plugin-techdocs-nodepackage. - Database specific
{ "cwe_ids": [ "CWE-94" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25153.json" }- References