CVE-2026-25153

Workarounds

If you cannot upgrade immediately:

1. Use Docker mode with restricted access: Configure TechDocs with runIn: docker instead of runIn: local. This provides container isolation, though it does not fully mitigate the risk.
2. Restrict repository access: Limit who can modify mkdocs.yml files in repositories that TechDocs processes. Only allow trusted contributors.
3. Manual review: Implement PR review requirements for changes to mkdocs.yml files to detect malicious hooks configurations before they are merged.
4. Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features.

Note: Building documentation in CI/CD pipelines using @techdocs/cli does not mitigate this vulnerability, as the CLI uses the same vulnerable @backstage/plugin-techdocs-node package.

References

MkDocs Hooks Documentation
MkDocs 1.4 Release Notes
TechDocs Architecture

When TechDocs is configured with runIn: local, a malicious actor who can submit or modify a repository's mkdocs.yml file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration.

Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.

CVE-2026-25153 has a CVSS score of 7.7 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.14.1, 1.13.11); upgrading removes the vulnerable code path.

Kodem intelligence

Upgrade to @backstage/plugin-techdocs-node version 1.13.11, 1.14.1 or later.
The fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (including hooks) are now removed from mkdocs.yml before running the generator, with a warning logged to indicate which keys were removed.

Note: Users of @techdocs/cli should also upgrade to the latest version, which includes the fixed @backstage/plugin-techdocs-node dependency.

1. What is CVE-2026-25153? CVE-2026-25153 is a high-severity code injection vulnerability in @backstage/plugin-techdocs-node (npm), affecting versions = 1.14.0. It is fixed in 1.14.1, 1.13.11. Untrusted input is evaluated as executable code within the application's runtime environment.
2. How severe is CVE-2026-25153? CVE-2026-25153 has a CVSS score of 7.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @backstage/plugin-techdocs-node are affected by CVE-2026-25153? @backstage/plugin-techdocs-node (npm) versions = 1.14.0 is affected.
4. Is there a fix for CVE-2026-25153? Yes. CVE-2026-25153 is fixed in 1.14.1, 1.13.11. Upgrade to this version or later.
5. Is CVE-2026-25153 exploitable, and should I be worried? Whether CVE-2026-25153 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-25153 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-25153?
   • Upgrade @backstage/plugin-techdocs-node to 1.14.1 or later
   • Upgrade @backstage/plugin-techdocs-node to 1.13.11 or later