CVE-2026-106505: Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation.
References
- github.com/advisories/GHSA-p75x-jh7p-ppcx
- github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9
- github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db
- github.com/backstage/backstage/releases/tag/v1.50.5
- github.com/backstage/backstage/releases/tag/v1.54.6
- github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx
- nvd.nist.gov/vuln/detail/CVE-2026-106505
Code Behaviors & Features
Detect and mitigate CVE-2026-106505 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →