{"kind": "product", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "name": "@backstage/plugin-techdocs-node", "product": "@backstage/plugin-techdocs-node", "ecosystem": "npm", "items": [{"id": "CVE-2026-106557", "noindex": false, "published": "2026-10-07T16:22:53.320Z", "modified": "2026-10-07T17:47:16.631Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00297, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106557", "title": "Backstage: Improper input validation in TechDocs Markdown extension configuration", "description": "Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-f7v3-xhm6-w245", "https://github.com/backstage/backstage/commit/017ace52d9b327ededc6704cf17799c875ae0f29", "https://github.com/backstage/backstage/commit/2d9de4ca117a529de4b6ed7dfb7aa507ca7b3f91"], "fixes": ["1.15.4"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-106558", "noindex": false, "published": "2026-10-07T14:45:25.679Z", "modified": "2026-10-10T02:27:17.131Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106558", "title": "Backstage: Improper validation of TechDocs MkDocs configuration", "description": "Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g", "https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b", "https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709"], "fixes": ["1.15.4"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-106510", "noindex": false, "published": "2026-10-07T14:36:53.929Z", "modified": "2026-10-07T17:15:43.410Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00479, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106510", "title": "Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml", "description": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. This issue is fixed in versions 1.14.6 and 1.15.4.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-4488-j8vj-vqqv", "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb", "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d"], "fixes": ["1.15.4"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-106509", "noindex": false, "published": "2026-10-06T21:50:07.721Z", "modified": "2026-10-07T18:01:48.511Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00516, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106509", "title": "Backstage: Improper validation of MkDocs theme configuration in TechDocs", "description": "Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c", "https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb", "https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d"], "fixes": ["1.15.4"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-106508", "noindex": false, "published": "2026-10-06T21:47:35.516Z", "modified": "2026-10-09T01:56:38.002Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106508", "title": "Backstage: Potential file exposure through local TechDocs publisher", "description": "Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. T", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-cm77-ch27-6w6v", "https://github.com/backstage/backstage/commit/6aecb26f337ffec1d4e67ce903cf1e39b6082ec4", "https://github.com/backstage/backstage/releases/tag/v1.54.6"], "fixes": ["1.15.4"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-106505", "noindex": false, "published": "2026-10-06T21:43:08.370Z", "modified": "2026-10-07T16:14:14.192Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00312, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106505", "title": "Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend", "description": "Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx", "https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9", "https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db"], "fixes": ["1.15.4"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-106455", "noindex": false, "published": "2026-10-06T20:06:06.505Z", "modified": "2026-10-09T01:46:59.251Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00333, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-106455", "title": "Backstage: Improper validation of MkDocs plugin configuration in TechDocs", "description": "Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fi", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m", "https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b", "https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0"], "fixes": ["1.14.7", "1.15.5"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}, {"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-29186", "noindex": false, "published": "2026-03-07T15:03:51.422Z", "modified": "2026-07-15T01:10:31.895Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00814, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-29186", "title": "@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution", "description": "Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw", "https://access.redhat.com/security/cve/CVE-2026-29186", "https://bugzilla.redhat.com/show_bug.cgi?id=2445480"], "fixes": ["1.14.3"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-25152", "noindex": false, "published": "2026-01-30T21:51:22.277Z", "modified": "2026-02-02T16:29:27.963Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00433, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25152", "title": "@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator", "description": "Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with `techdocs.generator.runIn: local`. When processing documentation from untrusted sources, symlinks within the docs directory are followed by MkDocs during the build process. File contents are embedded into generated HTML and exposed to users who can view the ", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-w669-jj7h-88m9", "https://nvd.nist.gov/vuln/detail/CVE-2026-25152"], "fixes": ["1.13.11", "1.14.1"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}, {"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "CVE-2026-25153", "noindex": false, "published": "2026-01-30T21:31:58.870Z", "modified": "2026-07-15T01:16:35.622Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00606, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-25153", "title": "@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks", "description": "Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with `runIn: local`, a malicious actor who can submit or modify a repository's `mkdocs.yml` file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. @backstage/plugin-techdocs-node versions 1.13.11 and 1.14.1 contain a fix. The fix introduces an allowlist of supported MkDocs configuration keys. Unsupported configuration keys (including `hooks`) are", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-6jr7-99pf-8vgf", "https://access.redhat.com/security/cve/CVE-2026-25153", "https://bugzilla.redhat.com/show_bug.cgi?id=2435576"], "fixes": ["1.13.11", "1.14.1"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}, {"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}, {"id": "GHSA-4jqc-jvh2-pxg9", "noindex": false, "published": "2022-06-17T01:11:10Z", "modified": "2022-06-17T01:11:10Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-4jqc-jvh2-pxg9", "title": "Path traversal for local publishers in TechDocs backend", "description": "### Impact\nA malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when `techdocs.publisher.type` is set to `local`.\n\nThis vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.\n\n### Patches\nThose affected are advised to upgrade to `@backstage/plugin-techdocs-node` version `1.1.2` or higher.\n\n### Workarounds\nIf patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or cus", "references": ["https://github.com/backstage/backstage/security/advisories/GHSA-4jqc-jvh2-pxg9", "https://github.com/backstage/backstage/commit/429c9f9daa5654dd1b996aa85f7264eb23a2e4fa", "https://github.com/backstage/backstage"], "fixes": ["1.1.2"], "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}]}], "total": 11, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@backstage/plugin-techdocs-node", "path": "vulns/npm/@backstage%2Fplugin-techdocs-node", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 7, "kev": 0}, "lastmod": "2026-10-10T02:27:17.131Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}