| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | = 1.51.0≥ 1.51.1, < 1.54.6< 1.50.5 | 1.54.61.50.5 |
| backstage plugin-techdocs-node | ≥ 1.15.0, < 1.15.4< 1.14.6 | 1.15.41.14.6 |
| @backstage/plugin-techdocs-node | < 1.15.4 | 1.15.4 |
When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process.
Patched in @backstage/plugin-techdocs-node version 1.15.4
techdocs.generator.runIn: 'docker' instead of 'local' to provide container isolation, though this does not fully mitigate the risk.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free