CVEvulnerability

CVE-2026-29186

9.8 CRITICAL Published 2026-03-07 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-03-07
Last modified
2026-07-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-434, CWE-74, CWE-791

Description

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.

Affected configurations

• linuxfoundation backstage plugin-techdocs-node (< 1.14.3)

Related

Weakness · CWE (3)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-791 Incomplete Filtering of Special Elements weakness

References