Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@backstage/plugin-techdocs-node

10 known vulnerabilities (8 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 8 high, 2 medium
Weekly downloads
287.9K
Dependents
10
Registry
npm

Advisories 10

  • Backstage: Improper input validation in TechDocs Markdown extension configuration

    Affected: fixed in 1.15.4.

  • Backstage: Improper validation of TechDocs MkDocs configuration

    Affected: fixed in 1.15.4.

  • Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

    Affected: fixed in 1.15.4.

  • Backstage: Improper validation of MkDocs theme configuration in TechDocs

    Affected: fixed in 1.15.4.

  • CVE-2026-106508Medium 5.3

    Backstage: Potential file exposure through local TechDocs publisher

    Affected: fixed in 1.15.4.

  • Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

    Affected: fixed in 1.15.4.

  • Backstage: Improper validation of MkDocs plugin configuration in TechDocs

    Affected: from 0.11.12, fixed in 1.14.7; from 1.15.0, fixed in 1.15.5.

  • @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

    Affected: fixed in 1.14.3.

  • CVE-2026-25152Medium 5.3

    @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

    Affected: from 1.14.0, fixed in 1.14.1; fixed in 1.13.11.

  • @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

    Affected: from 1.14.0, fixed in 1.14.1; fixed in 1.13.11.