CVE-2026-29186: @backstage/plugin techdocs node TechDocs Mkdocs Configuration Key Enables Vulnerability
HIGHCVE-2026-29186 is a HIGH (CVSS 7.7) techdocs mkdocs configuration key enables vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affecting @backstage/plugin techdocs node libraries in the npm ecosystem. The issue involves techdocs mkdocs configuration key enables arbitrary code execution. Remediation is available by upgrading affected packages to version 1.14.3.
CVE-2026-29186 at a Glance
Security Impact
CVSS: 7.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).
How to Fix CVE-2026-29186
To remediate this vulnerability, upgrade all affected @backstage/plugin techdocs node dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @backstage/plugin-techdocs-node@1.14.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @backstage/plugin-techdocs-nodeHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-29186, inspect your project dependencies using npm:
npm ls @backstage/plugin-techdocs-nodeAnalyze the terminal output to locate any version of @backstage/plugin techdocs node in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.14.3), your application is affected.
Note: The npm ls @backstage/plugin-techdocs-node command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type, where the product allows the upload or transfer of dangerous file types that are automatically processed within its environment. In @backstage/plugin techdocs node, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-29186 Affected @backstage/plugin techdocs node Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@backstage/plugin-techdocs-node
|
npm |
< 1.14.3
|
1.14.3
|
References
Frequently Asked Questions
What is CVE-2026-29186?
Which @backstage/plugin techdocs node versions are affected?
What version fixes CVE-2026-29186?
Is @backstage/plugin-techdocs-node affected?
What is the CVSS score of CVE-2026-29186?
What CWE is associated with CVE-2026-29186?
How can I check npm dependencies for CVE-2026-29186?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-928r-fm4v-mvrw",
"modified" : "2026-03-09T15:46:44Z",
"published" : "2026-03-05T00:12:07Z",
"aliases" : [ "CVE-2026-29186" ],
"summary" : "TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution",
"details" : "### Impact\nThis is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. \n\nA gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. \n\n### Patches\n\nPatched in `@backstage/plugin-techdocs-node` version 1.14.3\n\n### Workarounds\nIf users cannot upgrade immediately:\n\n1. Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk.\n2. Restrict repository access: Limit who can modify `mkdocs.yml` files in repositories that TechDocs processes. Only allow trusted contributors.\n3. Manual review: Implement PR review requirements for changes to `mkdocs.yml` files to detect malicious hooks configurations before they are merged.\n4. Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features.\n\nNote: Building documentation in CI/CD pipelines using `@techdocs/cli` does not mitigate this vulnerability, as the CLI uses the same vulnerable `@backstage/plugin-techdocs-node` package.\n\n### Resources\n[MkDocs Hooks Documentation](https://www.mkdocs.org/user-guide/configuration/#hooks)\n[MkDocs 1.4 Release Notes](https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27)\n[TechDocs Architecture](https://backstage.io/docs/features/techdocs/architecture)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@backstage/plugin-techdocs-node"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.14.3"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.14.2"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-29186"
}, {
"type" : "WEB",
"url" : "https://backstage.io/docs/features/techdocs/architecture"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/backstage/backstage"
}, {
"type" : "WEB",
"url" : "https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27"
}, {
"type" : "WEB",
"url" : "https://www.mkdocs.org/user-guide/configuration/#hooks"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-434", "CWE-74" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-05T00:12:07Z",
"nvd_published_at" : "2026-03-07T15:15:55Z"
}
}