CVE-2026-88064

{
  "etk_id": "ETK-2026-929",
  "cve_id": "CVE-2026-88064",
  "display_id": "CVE-2026-88064",
  "ghsa_id": "GHSA-292q-8mf5-h6g3",
  "euvd_id": "EUVD-2026-80784",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated configuration injection in Backstage TechDocs",
  "summary": "@backstage/plugin-techdocs-node releases before 1.14.6 and 1.15.0 through 1.15.3 improperly handle attacker-controlled TechDocs configuration. An authenticated user permitted to register or modify a TechDocs source can cause code to run in the documentation-generation environment, with access limited to resources available to its backend or build container.",
  "mitigation": "Upgrade @backstage/plugin-techdocs-node to 1.14.6 or 1.15.4, as appropriate for the deployed release line. Restrict TechDocs source registration and repository write access, and isolate documentation builds from secrets and unnecessary network access.",
  "vendor": "npm",
  "product": "npm:@backstage/plugin-techdocs-node",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.14.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.14.6"
      ],
      "package_name": "@backstage/plugin-techdocs-node",
      "purl": "pkg:npm/@backstage/plugin-techdocs-node"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.15.0, < 1.15.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.15.4"
      ],
      "package_name": "@backstage/plugin-techdocs-node",
      "purl": "pkg:npm/@backstage/plugin-techdocs-node"
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0118,
  "epss_percentile": 0.674,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.947867633333333,
  "t0_at": "2026-09-16T14:13:26.950000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-16T14:13:26.950000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-16T14:13:26.950000+00:00",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-292q-8mf5-h6g3"
    }
  }
}