CVE-2026-106510

{"id": "CVE-2026-106510", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106510", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T17:13:13.346488Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.50.5"}, {"status": "affected", "version": ">= 1.51.0-next.0, < 1.54.6"}]}, {"vendor": "@backstage", "product": "plugin-techdocs-node", "versions": [{"status": "affected", "version": "< 1.14.6"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.4"}]}]}], "published": "2026-10-07T15:17:12.430", "references": [{"url": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.50.5", "tags": ["Patch", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.6", "tags": ["Patch", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-183"}, {"lang": "en", "value": "CWE-470"}]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4."}], "lastModified": "2026-10-13T14:25:46.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5189301-5EC3-4F9F-952B-7993F3BFBF06", "versionEndExcluding": "1.14.6"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CB4C5CD-5A68-42D5-AE7F-65362C0E7165", "versionEndExcluding": "1.15.4", "versionStartIncluding": "1.15.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7", "versionEndExcluding": "1.50.5"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "949CA2FA-BF88-425F-910D-3D7E817E6420", "versionEndExcluding": "1.54.6", "versionStartIncluding": "1.51.1"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B"}, {"criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}