@backstage/plugin-techdocs-node@1.3.0-next.1

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malformed or object-keyed markdown_extensions configuration in a mkdocs.yml file. The function previously only handled array-form extension declarations and failed to normalize object/mapping-form configurations, allowing dangerous extension names or dynamically configured extensions (YAML tags) to bypass the sanitization filter. An authenticated attacker who can supply a crafted mkdocs.yml can inject dangerous Markdown extension configurations that are passed through to the MkDocs build process, leading to arbitrary file read or remote code execution.

Upgrade @backstage/plugin-techdocs-node to version 1.14.8, 1.15.6, 2.0.1 or higher.

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via unsanitized MkDocs plugin entries in mkdocs.yml during documentation generation in mkdocsPatchers.ts. Prior to the fix, the TechDocs generation pipeline did not enforce an allowlist of permitted MkDocs plugins, allowing a documentation author to specify arbitrary plugins - including those capable of making outbound HTTP requests or executing arbitrary code - in their mkdocs.yml. An attacker with the ability to author TechDocs content can inject plugins such as privacy or table-reader with attacker-controlled configuration (for example, pointing data_path at internal paths or external hosts), causing the backend to make unintended network requests and exfiltrate sensitive data during the documentation build process.

Upgrade @backstage/plugin-techdocs-node to version 1.14.7, 1.15.5 or higher.

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the sanitizeMkdocsYml function in mkdocsPatchers.ts, where the pymdownx.snippets MkDocs Markdown extension is permitted without constraining its configuration options. An authenticated attacker can supply a malicious mkdocs.yml with pymdownx.snippets configured to use a remote base_path or url_download option, causing the TechDocs build process to fetch arbitrary URLs from the server's network context, exposing internal resources.

Upgrade @backstage/plugin-techdocs-node to version 1.14.6, 1.15.4 or higher.

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Interpretation Conflict via the extra_templates key in MkDocs configuration handling in helpers.ts, where an attacker with the ability to supply a MkDocs configuration file can inject arbitrary Jinja2 templates that are rendered server-side, leading to high confidentiality impact and partial integrity and availability impact on the host system. The extra_templates key was included in the ALLOWED_MKDOCS_KEYS allowlist, permitting user-controlled template paths to be passed through to MkDocs without restriction.

Upgrade @backstage/plugin-techdocs-node to version 1.14.6, 1.15.4 or higher.

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via insufficient sanitization of markdown_extensions in mkdocs.yml during the documentation build stage. The sanitizeMkdocsYml function in mkdocsPatchers.ts does not adequately strip dangerous extension names (e.g., subprocess:Popen, os:system) or dangerous configuration keys (e.g., plantuml_cmd) from the markdown_extensions list before invoking MkDocs. An attacker with write access to a registered repository can place a mkdocs.yml containing these values, causing arbitrary command execution on the host or container performing the build.

Note: This is only exploitable when TechDocs is configured to build documentation locally or in a container, and the attacker has write access to a registered repository.

Upgrade @backstage/plugin-techdocs-node to version 1.14.6, 1.15.4 or higher.

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Symlink Attack via symlink handling in the LocalPublish publisher, where the publish pipeline copies documentation directories to a local storage path without validating that symbolic links within the source directory resolve to paths inside the documentation tree. An authenticated attacker who can influence the content of a TechDocs documentation directory can plant symlinks pointing to arbitrary host filesystem paths, causing the documentation serving endpoint to expose those files.

Note: This is only exploitable when the local TechDocs publisher is configured (techdocs.publisher.type: 'local').

Upgrade @backstage/plugin-techdocs-node to version 1.15.4 or higher.

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Directory Traversal via the TechdocsGenerator function when processing documentation from untrusted sources. An attacker can access sensitive files outside the intended directory by submitting symlinks within the docs, resulting in file contents being embedded into generated HTML and exposed to users who can view the documentation.

Upgrade @backstage/plugin-techdocs-node to version 1.13.11, 1.14.1 or higher.