The vulnerability allows an attacker to bypass the MkDocs configuration sanitizer in the TechDocs backend of Backstage. By committing malicious configuration changes to a repository that hosts TechDocs, the execute arbitrary code on the backend host. This leads to full compromise of the host running the documentation service, potentially exposing the entire developer portal and any associated infrastructure.

Backstage community editions using the @backstage/plugin-techdocs-node package (backstage:backstage) are affected. The flaw exists in versions released before 1.14.6 and 1.15.4; any deployments running 1.14.x prior to 1.14.6, or 1.15.x prior to 1.15.4, remain vulnerable.

The CVSS score of 7.7 classifies the issue as High. Because EPSS data is unavailable, the current exploit probability cannot be quantified; however, the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The attack requires commit rights to a repository used by TechDocs, so an attacker with write access to the codebase and the ability to trigger documentation builds could exploit this flaw. While direct network access to the backend is not required, the need for repository push privileges makes the problem limited to developers with sufficient repository permissions.