The flaw lies in the TechDocs plugin’s handling of MkDocs theme configuration, which lacks proper validation. A contributor with write access can embed malicious settings in mkdocs.yml that are executed during the documentation build, allowing arbitrary code execution with the build environment’s privileges. This compromises confidentiality, integrity, and availability of the system producing the docs.

Any Backstage install using @backstage/plugin-techdocs-node or the core backstage package before version 1.14.6 is vulnerable. Versions 1.14.6 and later, and 1.15.4, contain the fix. Earlier releases that have not applied these patches must be upgraded.

With a CVSS score of 7.7 the vulnerability is high. No EPSS information is available, and the vulnerability is not listed in CISA KEV, suggesting no publicly confirmed exploitation yet. Exploitation requires write access to the repository and the ability to trigger a documentation build locally or in CI. Because the arbitrary code runs under the build environment, the impact can be severe.