The flaw is in @backstage/plugin‑techdocs‑node and allows a malicious actor who can edit a repository’s mkdocs.yml file to inject arbitrary Python code that is executed during the local build of TechDocs. This grants the attacker full control of the build server where documentation is generated and can lead to compromise of the host system. The weakness is a code injection flaw (CWE‑94).

Backstage instances that use @backstage/plugin‑techdocs‑node before version 1.13.11 and before 1.14.1 are affected. These versions ship with the Backstage framework and are also used by the @techdocs/cli tool. Upgrading to version 1.13.11 or later, or to 1.14.1 or later, eliminates the vulnerability.

The vulnerability carries a CVSS score of 7.7 with an EPSS of less than 1%, and it is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to add or alter a mkdocs.yml file in a repository that TechDocs processes; if the build is run locally, the injected hooks code runs with the privileges of the build service. The risk is that an attacker who can modify repository content or influence pull requests can cause arbitrary code execution on the build server. Although running TechDocs in Docker mitigates process isolation, it does not fully eliminate the possibility of code injection. The risk is therefore significant for environments where local builds are performed and where repository write access is not tightly controlled.