GHSA-w669-jj7h-88m9

Suggest an improvement
Source
https://github.com/advisories/GHSA-w669-jj7h-88m9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w669-jj7h-88m9/GHSA-w669-jj7h-88m9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w669-jj7h-88m9
Aliases
Published
2026-02-02T14:36:39Z
Modified
2026-02-03T03:13:40Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
Details

Impact

A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local.

When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation.

Patches

This vulnerability is fixed in @backstage/plugin-techdocs-node version X.X.X. Users should upgrade to this version or later.

Workarounds

  • Switch to runIn: docker in your app-config.yaml:
  techdocs:
    generator:
      runIn: docker
  • Restrict write access to TechDocs source repositories to trusted users only

References

Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-02T14:36:39Z",
    "nvd_published_at":  "2026-01-30T22:15:56Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / @backstage/plugin-techdocs-node

Package

Name
@backstage/plugin-techdocs-node
View open source insights on deps.dev
Purl
pkg:npm/%40backstage/plugin-techdocs-node

Affected ranges

Type
SEMVER
Events
Introduced
1.14.0
Fixed
1.14.1

Affected versions

1.*
1.14.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w669-jj7h-88m9/GHSA-w669-jj7h-88m9.json"

npm / @backstage/plugin-techdocs-node

Package

Name
@backstage/plugin-techdocs-node
View open source insights on deps.dev
Purl
pkg:npm/%40backstage/plugin-techdocs-node

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.13.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w669-jj7h-88m9/GHSA-w669-jj7h-88m9.json"