The vulnerability arises when the @backstage/plugin-techdocs-node plugin processes a custom markdown_extensions section in a mkdocs.yml file, allowing an attacker who can create or modify catalog entities to craft configuration that triggers arbitrary OS command execution on the TechDocs build host; this flaw results from improper handling of directional overrides (CWE‑183), unsafe script execution paths (CWE‑470), and OS command injection (CWE‑78), giving the attacker the ability to run any command on the build service with its privileges.

The defect is present in Backstage core and the @backstage/plugin-techdocs-node package in releases prior to 1.14.6 and 1.15.4; any environment running those older versions that hosts the TechDocs build service and enables non‑trusted users to register catalog entities is vulnerable.

The CVSS score of 7.7 indicates high risk, and because the vulnerability requires authenticated catalog management privileges, the exploitation window is limited to internal or compromised accounts; the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, so the likelihood of widespread external exploitation is low but the potential impact remains significant for affected installations.