CVE-2026-88064 Linuxfoundation — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	8.8 (HIGH)
Affected Versions	1.15.0 — 1.15.4
Fixed In	1.14.6
Type	CWE-20 (Improper Input Validation), CWE-1336 (Template Injection)
Vendor	Linuxfoundation
Public PoC	No

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the documentation generator and cause unintended code execution.

The resulting impact is limited to the files, credentials, network access, and other resources available to the TechDocs backend or build container. This issue is fixed in versions 1.14.6 and 1.15.4.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-20 Improper Input Validation

CWE-1336 Template Injection

Vulnerable Products 4

Configuration	From (including)	Up to (excluding)
Linuxfoundation Backstage_Plugin-Techdocs-Node cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node::::::::	—	`1.14.6`
Linuxfoundation Backstage_Plugin-Techdocs-Node cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node::::::::	`1.15.0`	`1.15.4`
Linuxfoundation Backstage cpe:2.3:a:linuxfoundation:backstage::::::::	—	`1.14.6`
Linuxfoundation Backstage cpe:2.3:a:linuxfoundation:backstage::::::::	`1.15.0`	`1.15.4`