« Volver al listado

CVE-2026-106510

Estado: AnalizadaAlta (7.7)—

Backstage es un framework abierto para crear portales de desarrolladores. Antes de 1.14.6, el paquete @backstage/plugin-techdocs-node se ve afectado por una ejecución remota de código mediante markdown_extensions manipuladas en el mkdocs.yml de techdocs. Un usuario autenticado que pueda registrar entidades del catálogo puede proporcionar un mkdocs.yml manipulado que provoque la ejecución de comandos arbitrarios del sistema operativo en el host de compilación de TechDocs cuando se compila la documentación. Este problema está corregido en las versiones 1.14.6 y 1.15.4.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en servicio remoto (Backstage TechDocs) que requiere autenticación (PR:L) y red para ejecutar comandos arbitrarios via mkdocs.yml malicioso en el host de build.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (2)

Linuxfoundation — BackstageLinuxfoundation — Backstage Plugin-techdocs-node

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-106510",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106510",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-07T17:13:13.346488Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.50.5"
            },
            {
              "status": "affected",
              "version": ">= 1.51.0-next.0, < 1.54.6"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-techdocs-node",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.14.6"
            },
            {
              "status": "affected",
              "version": ">= 1.15.0, < 1.15.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T15:17:12.430",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-183"
        },
        {
          "lang": "en",
          "value": "CWE-470"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4."
    }
  ],
  "lastModified": "2026-10-13T14:25:46.490",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5189301-5EC3-4F9F-952B-7993F3BFBF06",
              "versionEndExcluding": "1.14.6"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CB4C5CD-5A68-42D5-AE7F-65362C0E7165",
              "versionEndExcluding": "1.15.4",
              "versionStartIncluding": "1.15.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7",
              "versionEndExcluding": "1.50.5"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "949CA2FA-BF88-425F-910D-3D7E817E6420",
              "versionEndExcluding": "1.54.6",
              "versionStartIncluding": "1.51.1"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}