@backstage/plugin-techdocs-node kwetsbaar voor willekeurige code-uitvoering via MkDocs hooks

The primary impact of CVE-2026-25153 is the potential for remote code execution on the TechDocs build server. An attacker who can submit or modify a repository's mkdocs.yml file can inject malicious code through the MkDocs hooks configuration. This could lead to a complete compromise of the build server, allowing the attacker to steal sensitive data, install malware, or pivot to other systems within the network. The runIn: local configuration setting significantly increases the risk, as it allows the build process to execute code directly on the server rather than within a sandboxed environment. This vulnerability shares similarities with other MkDocs configuration vulnerabilities where improper sanitization of user-provided input leads to code execution.

Organizations using @backstage/plugin-techdocs-node with the runIn: local configuration are at significant risk. This includes teams that rely on automated documentation generation pipelines and allow external contributors to modify repository content. Shared hosting environments where multiple users have access to repository configurations are also particularly vulnerable.

• nodejs / server:

  find /path/to/techdocs/ -name 'mkdocs.yml' -print0 | xargs -0 grep -i 'hooks:'

• nodejs / server:

npm list @backstage/plugin-techdocs-node

• generic web: Inspect mkdocs.yml files in repositories managed by TechDocs for the presence of the hooks configuration key.

1. 2026-02-02Disclosure

   disclosure

1. Gereserveerd2026-01-29
2. Gepubliceerd2026-02-02
3. Gewijzigd2026-02-03
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-25153 is to upgrade to @backstage/plugin-techdocs-node version 1.14.1 or later. This version introduces an allowlist of supported MkDocs configuration keys, effectively removing the hooks configuration and preventing arbitrary code execution. If upgrading immediately is not possible, consider temporarily disabling the runIn: local configuration, which significantly reduces the attack surface. Review all mkdocs.yml files within your repositories for any unusual or unexpected configurations. Implement strict access controls to prevent unauthorized modification of repository content. After upgrading, confirm the fix by inspecting the TechDocs build logs for warnings related to removed configuration keys.