Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Deserialization of Untrusted Data in `sanitizeMkdocsYml` within `mkdocsPatchers.ts` via malformed or object-keyed `markdown_extensions` configuration in a `mkdocs.yml` file. The function previously only handled array-form extension declarations and failed to normalize object/mapping-form configurations, allowing dangerous extension names or dynamically configured extensions (YAML tags) to bypass the sanitization filter. An authenticated attacker who can supply a crafted `mkdocs.yml` can inject dangerous Markdown extension configurations that are passed through to the MkDocs build process, leading to arbitrary file read or remote code execution. How to fix Deserialization of Untrusted Data? Upgrade `@backstage/plugin-techdocs-node` to version 1.14.8, 1.15.6, 2.0.1 or higher.	<1.14.8>=1.15.0 <1.15.6>=2.0.0 <2.0.1

Deserialization of Untrusted Data

@backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malformed or object-keyed markdown_extensions configuration in a mkdocs.yml file. The function previously only handled array-form extension declarations and failed to normalize object/mapping-form configurations, allowing dangerous extension names or dynamically configured extensions (YAML tags) to bypass the sanitization filter. An authenticated attacker who can supply a crafted mkdocs.yml can inject dangerous Markdown extension configurations that are passed through to the MkDocs build process, leading to arbitrary file read or remote code execution.

How to fix Deserialization of Untrusted Data?

Upgrade @backstage/plugin-techdocs-node to version 1.14.8, 1.15.6, 2.0.1 or higher.

<1.14.8>=1.15.0 <1.15.6>=2.0.0 <2.0.1

Go back to all versions of this package