Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-44tf-rp9m-yqgm
|
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`.
When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the documentation.
|
CVE-2026-25152
GHSA-w669-jj7h-88m9
|
|
VCID-a2ex-8at2-9yeu
|
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
When TechDocs is configured with `runIn: local`, a malicious actor who can submit or modify a repository's `mkdocs.yml` file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration.
|
CVE-2026-25153
GHSA-6jr7-99pf-8vgf
|