A critical code injection vulnerability in the Backstage plugin-techdocs-node package allows for remote code execution, posing a significant risk to the integrity of developer portal infrastructure.

This is an improper control of code generation (CWE-94) vulnerability. When TechDocs is configured to run locally, an authenticated user who can modify a repository's mkdocs.yml file can inject arbitrary Python code via MkDocs hooks, which the server then executes.

The ability to execute arbitrary code on the build server allows an attacker to compromise the build pipeline, potentially leading to unauthorized access to sensitive source code, environment variables, or other credentials stored on the server. With a CVSS score of 7.7, this vulnerability represents a high risk to organizational security, as it grants attackers the ability to escalate privileges within the development environment and potentially move laterally into production systems.

Immediate Action: Update the @backstage/plugin-techdocs-node dependency to version 1.13.11 or 1.14.1 immediately. Users of @techdocs/cli must also upgrade to the latest version to ensure the patched dependency is utilized.

Proactive Monitoring: Monitor build server logs for unexpected configuration warnings or unauthorized attempts to modify mkdocs.yml files. Review system activity on build servers for unusual process execution, particularly those involving Python or MkDocs hooks.

Compensating Controls: If immediate patching is not feasible, reconfigure TechDocs to use runIn: docker to provide container isolation, although this does not fully eliminate the risk. Restrict repository write permissions to trusted contributors only to prevent unauthorized modifications to mkdocs.yml files.

Public Exploit Available: Unknown

Given the potential for remote code execution within the build pipeline, this vulnerability should be prioritized for remediation. Administrators must verify their TechDocs configuration and apply the recommended package updates to prevent unauthorized code execution. Failure to patch may allow attackers to gain persistence within the development infrastructure, leading to broader compromise of the software supply chain.