{
  "acceptance_criteria": [
    "Affected product or dependency presence is confirmed by a human.",
    "Affected version is confirmed or marked not applicable.",
    "Official advisory or source reference is reviewed.",
    "Patch, fixed version, mitigation, workaround, or monitor-only decision is documented.",
    "Validation steps are proposed without external scanning or production mutation."
  ],
  "affected_context": {
    "component": null,
    "cpe": [],
    "ecosystems": [],
    "product": "backstage_plugin-techdocs-node",
    "purl": [],
    "vendor": "linuxfoundation",
    "versions": [
      "1.51.0",
      "1.55.0"
    ]
  },
  "canonical_signal_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-106558/",
  "cve_id": "CVE-2026-106558",
  "generated_at": "2026-10-14T14:36:31.011154+00:00",
  "human_checklist": [
    "Confirm whether the listed product or package is present.",
    "Confirm affected version.",
    "Review vendor advisory or official source.",
    "Confirm patch, fixed version, mitigation, workaround, or monitor-only decision.",
    "Confirm exposure.",
    "Document remediation status."
  ],
  "pack_version": "remediation-handoff/0.1",
  "redaction_policy": {
    "exploit_steps_removed": true,
    "payloads_removed": true,
    "scanner_instructions_removed": true,
    "source_published_defensive_context_allowed": true
  },
  "remediation_context": {
    "fixed_versions": [
      "versions"
    ],
    "mitigation_notes": [
      "Patch confirmed by source text; fixed version context: versions."
    ],
    "patch_status": "confirmed",
    "recommended_route": "vendor_patch_or_mitigation",
    "reference_status": "official_reference_present"
  },
  "risk_context": {
    "cvss_label": "HIGH",
    "cvss_score": 8.8,
    "epss_percentile": 0.39056,
    "kev_status": "not_listed",
    "risk_flags": [
      "CVSS HIGH",
      "official reference present"
    ],
    "severity": "HIGH"
  },
  "rollback_note": "If remediation work is later performed, define a project-specific rollback plan before changing any production system.",
  "safe_agent_handoff": {
    "allowed_actions": [
      "summarize vendor guidance",
      "prepare a defensive remediation plan",
      "identify affected dependencies only when repo context is separately provided by the user",
      "suggest tests and validation steps",
      "document human verification questions"
    ],
    "auto_remediation_allowed": false,
    "disallowed_actions": [
      "generate offensive code",
      "provide payloads",
      "scan external targets",
      "change production systems",
      "merge or deploy changes",
      "create GitHub issues or pull requests without explicit separate approval"
    ],
    "external_execution_allowed": false,
    "goal": "Prepare a defensive remediation plan for CVE-2026-106558 using only provided public-safe source context and any separate repo context supplied by the user.",
    "human_approval_required": true,
    "scan_allowed": false
  },
  "safety_notes": [
    "Defensive triage and remediation planning only.",
    "No offensive procedure, payload material, external target scan, or auto-remediation instruction is included.",
    "KEV not listed means not listed in the KEV catalog for this record; it does not prove absence of exploitation."
  ],
  "source_context": {
    "references": [
      "https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b",
      "https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709",
      "https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c",
      "https://github.com/backstage/backstage/releases/tag/v1.50.7",
      "https://github.com/backstage/backstage/releases/tag/v1.54.9",
      "https://github.com/backstage/backstage/releases/tag/v1.55.2",
      "https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g"
    ],
    "source_names": [
      "NVD",
      "OSV",
      "Vendor Advisory"
    ],
    "source_published_impact": "Source describes code execution review · authenticated boundary. Possible impact: An attacker may be able to run code or commands on affected systems.",
    "source_published_summary": "NVD: Backstage is an open framework for building developer portals. NVD: Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. NVD: An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution."
  }
}