CVE-2026-29186
HIGHBackstage plugin-techdocs-node < 1.14.3 - Arbitrary Code Execution via MkDocs Configuration Bypass
Title source: llmDescription
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.
References (6)
Core 6
Core References
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13826
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:9742
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-29186
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445480
Vendor Advisory x_refsource_confirm
https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
Scores
CVSS v3
7.7
EPSS
0.0078
EPSS Percentile
52.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-434
CWE-74
CWE-791
Status
published
Products (3)
backstage/backstage
< 1.14.3
backstage/plugin-techdocs-node
0 - 1.14.3npm
linuxfoundation/backstage_plugin-techdocs-node
< 1.14.3
Published
Mar 07, 2026
Tracked Since
Mar 07, 2026