« Volver al listado

CVE-2026-106558

Estado: AnalizadaAlta (8.8)—

Backstage es un framework abierto para crear portales de desarrolladores. Antes de 1.14.8, 1.15.6 y 2.0.1, el paquete @backstage/plugin-techdocs-node validaba incorrectamente la configuración markdown_extensions de tipo mapeo. Un atacante autenticado que pueda registrar o influir en una fuente de documentación respaldada por SCM puede eludir el saneamiento de TechDocs y hacer que se importen e instancien objetos Python en el runtime del generador, lo que provoca la ejecución de código arbitrario.

Leer descripción completaMostrar menos

Las correcciones anteriores en las versiones 1.14.6 y 1.15.4 no abordaban por completo la representación de tipo mapeo admitida de markdown_extensions. El impacto es mayor cuando la generación de documentación se ejecuta con credenciales del backend, acceso al sistema de archivos o acceso a la red interna. Este problema está corregido en las versiones 1.14.8, 1.15.6 y 2.0.1.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-502 (deserialization insegura) con acceso remoto autenticado (AV:N, PR:L) permite instanciar objetos Python arbitrarios en el generador, logrando RCE. Riesgo crítico si se ejecuta con credenciales backend.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser Training

Tecnologías afectadas (2)

Linuxfoundation — BackstageLinuxfoundation — Backstage Plugin-techdocs-node

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-106558",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106558",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-10T02:27:02.807453Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "backstage",
          "product": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.50.7"
            },
            {
              "status": "affected",
              "version": ">= 1.51.0-next.0, < 1.54.9"
            },
            {
              "status": "affected",
              "version": ">= 1.55.0-next.0, < 1.55.2"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-techdocs-node",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.14.8"
            },
            {
              "status": "affected",
              "version": ">= 1.15.0, < 1.15.6"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-07T15:17:15.713",
  "references": [
    {
      "url": "https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.50.7",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.9",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/releases/tag/v1.55.2",
      "tags": [
        "Patch",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1."
    }
  ],
  "lastModified": "2026-10-13T14:25:12.163",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD94EA16-A1E8-4D5B-AE94-6A2A19DD9652",
              "versionEndExcluding": "1.14.8"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38BE2876-375D-42DC-9346-9EE966A30FAE",
              "versionEndExcluding": "1.15.6",
              "versionStartIncluding": "1.15.0"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B031C8F4-D118-4ACB-A362-AB52CB675D26",
              "versionEndExcluding": "2.0.1",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9EAD440-2350-49BD-927E-57F189E3A7A1",
              "versionEndExcluding": "1.50.7"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38754AA7-90F4-4854-BB3C-A7E4D0CB3B34",
              "versionEndExcluding": "1.54.8",
              "versionStartIncluding": "1.51.1"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D98B294F-6829-41ED-A005-1F6ECC7C16E6",
              "versionEndExcluding": "1.55.2",
              "versionStartIncluding": "1.55.1"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91628A7C-3017-4ACD-A100-330BB9F983B2"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C1DE1E3-862E-4512-A66B-9804B2451D7F"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5D0AF99-42C1-4AD2-84D6-11327EFD314B"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3796F724-6F1F-45CA-BB1F-5F2DCCC37986"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.55.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB589509-6A43-43CF-B853-9747DF7F86AB"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.55.0:next0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58A6FDC7-17FF-4543-A35B-06889305B888"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.55.0:next1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7296B6F-E068-42DB-9E1E-164EA86DC5EA"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:backstage:1.55.0:next2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80371A9C-E360-4001-B12D-B5BFC22D2F57"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}