Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4t54-csrc-57g3
Vulnerability ID VCID-4t54-csrc-57g3
Aliases CVE-2026-29186
GHSA-928r-fm4v-mvrw
Summary TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution This is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls.
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-791 Incomplete Filtering of Special Elements
System Score Found at
cvssv3 9.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29186.json
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2026-29186
cvssv3.1 7.7 https://backstage.io/docs/features/techdocs/architecture
generic_textual HIGH https://backstage.io/docs/features/techdocs/architecture
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-928r-fm4v-mvrw
cvssv3.1 7.7 https://github.com/backstage/backstage
generic_textual HIGH https://github.com/backstage/backstage
cvssv3.1 7.7 https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
cvssv3.1_qr HIGH https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
generic_textual HIGH https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
ssvc Track https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
cvssv3.1 7.7 https://nvd.nist.gov/vuln/detail/CVE-2026-29186
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-29186
cvssv3.1 7.7 https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27
generic_textual HIGH https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27
cvssv3.1 7.7 https://www.mkdocs.org/user-guide/configuration/#hooks
generic_textual HIGH https://www.mkdocs.org/user-guide/configuration/#hooks
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29186.json
https://api.first.org/data/v1/epss?cve=CVE-2026-29186
https://backstage.io/docs/features/techdocs/architecture
https://github.com/backstage/backstage
https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27
https://www.mkdocs.org/user-guide/configuration/#hooks
2445480 https://bugzilla.redhat.com/show_bug.cgi?id=2445480
CVE-2026-29186 https://nvd.nist.gov/vuln/detail/CVE-2026-29186
GHSA-928r-fm4v-mvrw https://github.com/advisories/GHSA-928r-fm4v-mvrw
GHSA-928r-fm4v-mvrw https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
RHSA-2026:13826 https://access.redhat.com/errata/RHSA-2026:13826
RHSA-2026:9742 https://access.redhat.com/errata/RHSA-2026:9742
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29186.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://backstage.io/docs/features/techdocs/architecture
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/backstage/backstage
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-09T20:15:04Z/ Found at https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-29186
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L Found at https://www.mkdocs.org/user-guide/configuration/#hooks
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11779
EPSS Score 0.00038
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:07:35.937624+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@backstage/plugin-techdocs-node/CVE-2026-29186.yml 38.6.0