The vulnerability arises from insufficient validation of the MkDocs configuration file (mkdocs.yml) used during TechDocs generation in the Backstage framework. An authenticated user who has the ability to register or modify documentation sources can supply malicious configuration data, allowing the execution of arbitrary shell commands within the build environment. This flaw leads to remote code execution restricted to the resources accessible from the TechDocs backend or its build container, compromising the integrity of the build process and potentially the host system if container isolation is misconfigured.

Affected products include the @backstage/plugin-techdocs-node package and the core backstage:backstage framework. All releases older than 1.14.6 contain the flaw; the issue is fixed in Backstage 1.14.6, 1.15.4, and later versions.

The CVSS base score is 7.7, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permissions to register or modify documentation sources. Once that privilege is achieved, the attacker can run commands in the build container with the same privileges as the build process. The impact is limited to the build environment, though it could be leveraged to pivot to other components if isolation is breached. Attackers are likely to target organizations using older Backstage releases without proper user access controls.