CVE-2026-25153: RCE in @backstage/plugin-techdocs-node

The primary impact of CVE-2026-25153 is the potential for remote code execution on the TechDocs build server. An attacker who can submit or modify a repository's mkdocs.yml file can inject malicious code through the MkDocs hooks configuration. This could lead to a complete compromise of the build server, allowing the attacker to steal sensitive data, install malware, or pivot to other systems within the network. The runIn: local configuration setting significantly increases the risk, as it allows the build process to execute code directly on the server rather than within a sandboxed environment. This vulnerability shares similarities with other MkDocs configuration vulnerabilities where improper sanitization of user-provided input leads to code execution.

1. Reserved2026-01-29
2. Published2026-02-02
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25153 is to upgrade to @backstage/plugin-techdocs-node version 1.14.1 or later. This version introduces an allowlist of supported MkDocs configuration keys, effectively removing the hooks configuration and preventing arbitrary code execution. If upgrading immediately is not possible, consider temporarily disabling the runIn: local configuration, which significantly reduces the attack surface. Review all mkdocs.yml files within your repositories for any unusual or unexpected configurations. Implement strict access controls to prevent unauthorized modification of repository content. After upgrading, confirm the fix by inspecting the TechDocs build logs for warnings related to removed configuration keys.