CVE-2026-29186
High · 7.7CVSS
7.7
EPSS
0.9%
Published
Mar 7, 2026
CISA due date
—
The record
Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @backstage/plugin-techdocs-node | 0 | 1.14.3 |
Related vulnerabilities
- GHSA-928r-fm4v-mvrw TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution Same vulnerability
- GHSA-6jr7-99pf-8vgf @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks Also affects @backstage/plugin-techdocs-node
- GHSA-w669-jj7h-88m9 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local… Also affects @backstage/plugin-techdocs-node
- CVE-2026-25152 Backstage is an open framework for building developer portals, and… Also affects @backstage/plugin-techdocs-node
- CVE-2026-25153 Backstage is an open framework for building developer portals, and… Also affects @backstage/plugin-techdocs-node
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-74
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-74
- CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-74