Impact
This is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process.
A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls.
Patches
Patched in @backstage/plugin-techdocs-node version 1.14.3
Workarounds
If users cannot upgrade immediately:
- Use Docker mode with restricted access: Configure TechDocs with
runIn: docker instead of runIn: local. This provides container isolation, though it does not fully mitigate the risk.
- Restrict repository access: Limit who can modify
mkdocs.yml files in repositories that TechDocs processes. Only allow trusted contributors.
- Manual review: Implement PR review requirements for changes to
mkdocs.yml files to detect malicious hooks configurations before they are merged.
- Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features.
Note: Building documentation in CI/CD pipelines using @techdocs/cli does not mitigate this vulnerability, as the CLI uses the same vulnerable @backstage/plugin-techdocs-node package.
Resources
MkDocs Hooks Documentation
MkDocs 1.4 Release Notes
TechDocs Architecture
References
Impact
This is a configuration bypass vulnerability that enables arbitrary code execution. The
@backstage/plugin-techdocs-nodepackage uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process.A gap in this allowlist allows attackers to craft an
mkdocs.ymlthat causes arbitrary Python code execution, completely bypassing TechDocs' security controls.Patches
Patched in
@backstage/plugin-techdocs-nodeversion 1.14.3Workarounds
If users cannot upgrade immediately:
runIn: dockerinstead ofrunIn: local. This provides container isolation, though it does not fully mitigate the risk.mkdocs.ymlfiles in repositories that TechDocs processes. Only allow trusted contributors.mkdocs.ymlfiles to detect malicious hooks configurations before they are merged.Note: Building documentation in CI/CD pipelines using
@techdocs/clidoes not mitigate this vulnerability, as the CLI uses the same vulnerable@backstage/plugin-techdocs-nodepackage.Resources
MkDocs Hooks Documentation
MkDocs 1.4 Release Notes
TechDocs Architecture
References