CVE-2026-29186: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29186 is a configuration bypass vulnerability in the @backstage/plugin-techdocs-node npm package that enables arbitrary Python code execution during the documentation build process. The package uses an allowlist to filter dangerous MkDocs configuration keys, but a gap in this allowlist allows attackers to craft a malicious mkdocs.yml file that completely bypasses TechDocs' security controls. It affects all versions up to and including 1.14.2, with the fix released in version 1.14.3. The vulnerability was published on March 4, 2026, and assigned a CVSS v3.1 score of 7.7 (High) by the GitHub Advisory Database (GitHub Advisory, Backstage Advisory).

The root cause is an incomplete allowlist (CWE-74: Injection; CWE-434: Unrestricted Upload of File with Dangerous Type) in the @backstage/plugin-techdocs-node package that fails to block the MkDocs hooks configuration key, introduced in MkDocs 1.4.0. The hooks feature allows arbitrary Python scripts to be executed during the MkDocs build process, and because TechDocs does not filter this key, an attacker who can supply or modify an mkdocs.yml file can embed a hooks entry pointing to a malicious Python script. Exploitation requires the attacker to have write access to a repository whose documentation is processed by TechDocs, and the build must be triggered (e.g., via a CI/CD pipeline or TechDocs' own build process). Notably, using @techdocs/cli in CI/CD pipelines does not mitigate the risk, as it relies on the same vulnerable package (GitHub Advisory, Backstage Advisory).

Successful exploitation allows an attacker to execute arbitrary Python code in the context of the TechDocs build process, resulting in high confidentiality impact (access to secrets, environment variables, and file system data), and meaningful integrity and availability impacts. Because the scope is changed (the vulnerable component can affect resources beyond its security boundary), attackers may be able to pivot to other systems or services accessible from the build environment. The attack requires low privileges (repository write access) and no user interaction beyond triggering a documentation build (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.038% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for an attacker to have write access to a repository processed by TechDocs and the use of MkDocs ≥ 1.4.0 (GitHub Advisory).

1. Gain repository write access: Obtain contributor or write access to a repository whose documentation is built by a Backstage TechDocs instance running @backstage/plugin-techdocs-node ≤ 1.14.2 with MkDocs ≥ 1.4.0.
2. Craft a malicious mkdocs.yml: Add or modify the mkdocs.yml file in the repository to include a hooks key referencing a malicious Python script, e.g.:

hooks:
  - malicious_hook.py

3. Add the malicious Python script: Commit a Python file (e.g., malicious_hook.py) to the repository containing the desired payload, such as a reverse shell, credential exfiltration, or file system manipulation.
4. Trigger a documentation build: Push the changes or open a pull request that causes TechDocs to initiate a documentation build. This can occur automatically via CI/CD integration or manually through the Backstage UI.
5. Achieve code execution: During the MkDocs build, the hooks script is executed in the build environment, giving the attacker arbitrary Python code execution with the privileges of the TechDocs build process (GitHub Advisory, Backstage Advisory).

• File System: Unexpected Python script files (e.g., *.py) committed alongside or referenced in mkdocs.yml in documentation repositories; presence of a hooks: key in mkdocs.yml files pointing to local scripts.
• Logs: TechDocs or MkDocs build logs showing execution of Python hook scripts not previously present; unexpected process spawning (e.g., python, curl, wget, bash) during documentation builds.
• Network: Outbound network connections from the TechDocs build environment to unknown external IPs or domains during or immediately after a documentation build.
• Process: Unusual child processes spawned by the MkDocs or TechDocs build process, particularly Python interpreters executing scripts from the repository working directory (GitHub Advisory).

Upgrade @backstage/plugin-techdocs-node to version 1.14.3 or later, which patches the allowlist gap. If immediate upgrade is not possible, the following workarounds are recommended (in order of preference): (1) Switch TechDocs to Docker mode (runIn: docker) for container isolation; (2) restrict write access to mkdocs.yml files to trusted contributors only; (3) enforce mandatory PR reviews for changes to mkdocs.yml; (4) downgrade MkDocs to a version prior to 1.4.0 (e.g., 1.3.1), which does not support the hooks feature — though this limits access to newer MkDocs functionality. Note that using @techdocs/cli in CI/CD does not mitigate the vulnerability (GitHub Advisory, Backstage Advisory).

The advisory was published by benjdlambert on behalf of the Backstage project on March 4, 2026, and reviewed by the GitHub Advisory Database on March 5, 2026. Red Hat issued related errata (RHSA-2026:9742 and RHSA-2026:13826) addressing the vulnerability in their product offerings (Red Hat Errata). Community discussion was noted on Bluesky and security aggregator sites shortly after disclosure, though no major public controversy or widespread media coverage has been identified.