CVE-2026-29186: @backstage/plugin-techdocs-node Arbitrary Code Execution Vulnerability
Summary
CVE-2026-29186: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution. Affects @backstage/plugin-techdocs-node versions < 1.14.3. Fixed in 1.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs-node package is a component of the Backstage framework that facilitates the creation and management of documentation using MkDocs. It allows users to build and serve documentation sites efficiently. However, due to a configuration bypass vulnerability, it is susceptible to arbitrary code execution, which can compromise the security of applications using this package.
Vulnerability Detail
This vulnerability arises from a flaw in the allowlist mechanism that filters dangerous MkDocs configuration keys during the documentation build process. Attackers can exploit this gap by crafting a malicious mkdocs.yml file that executes arbitrary Python code, thereby bypassing the security controls implemented by TechDocs. The implications of this vulnerability are severe, as it can lead to unauthorized code execution within the application environment.
How To Fix
Latest published version: 2.1.0 as of 23 Oct 2026
npm install @backstage/plugin-techdocs-node@2.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.14.3
This is the first release that contains the fix.
npm install @backstage/plugin-techdocs-node@1.14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider the following workarounds: 1. Use Docker mode with restricted access by configuring TechDocs with 'runIn: docker' instead of 'runIn: local' for container isolation. 2. Restrict repository access to limit modifications to mkdocs.yml files, allowing only trusted contributors. 3. Implement PR review requirements for changes to mkdocs.yml files to detect malicious configurations. 4. Downgrade MkDocs to a version below 1.4.0 (e.g., 1.3.1) which does not support hooks, although this may limit access to newer features.
Conclusion
The CVE-2026-29186 vulnerability in the @backstage/plugin-techdocs-node package poses a significant risk due to its ability to enable arbitrary code execution. It is crucial for users to update to the patched version or implement the recommended workarounds to mitigate the risk. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain application security.
See every vulnerability recorded for @backstage/plugin-techdocs-node →
FAQ
CVE-2026-29186 is a vulnerability in the @backstage/plugin-techdocs-node package that allows for arbitrary code execution due to a configuration bypass.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
If you cannot upgrade immediately, consider implementing the suggested workarounds to mitigate the risk until you can apply the patch.
The potential impacts include unauthorized execution of arbitrary code, which can compromise the security of the application and lead to data breaches or system compromise.
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-techdocs-node.
