CVE-2026-29186

### Impact This is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. ### Patches Patched in `@backstage/plugin-techdocs-node` version 1.14.3 ### Workarounds If users cannot upgrade immediately: 1. Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk. 2. Restrict repository access: Limit who can modify `mkdocs.yml` files in repositories that TechDocs processes. Only allow trusted contributors. 3. Manual review: Implement PR review requirements for changes to `mkdocs.yml` files to detect malicious hooks configurations before they are merged. 4. Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features. Note: Building documentation in CI/CD pipelines using `@techdocs/cli` does not mitigate this vulnerability, as the CLI uses the same vulnerable `@backstage/plugin-techdocs-node` package. ### Resources [MkDocs Hooks Documentation](https://www.mkdocs.org/user-guide/configuration/#hooks) [MkDocs 1.4 Release Notes](https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27) [TechDocs Architecture](https://backstage.io/docs/features/techdocs/architecture)

### Impact This is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. ### Patches Patched in `@backstage/plugin-techdocs-node` version 1.14.3 ### Workarounds If users cannot upgrade immediately: 1. Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk. 2. Restrict repository access: Limit who can modify `mkdocs.yml` files in repositories that TechDocs processes. Only allow trusted contributors. 3. Manual review: Implement PR review requirements for changes to `mkdocs.yml` files to detect malicious hooks configurations before they are merged. 4. Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features. Note: Building documentation in CI/CD pipelines using `@techdocs/cli` does not mitigate this vulnerability, as the CLI uses the same vulnerable `@backstage/plugin-techdocs-node` package. ### Resources [MkDocs Hooks Documentation](https://www.mkdocs.org/user-guide/configuration/#hooks) [MkDocs 1.4 Release Notes](https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27) [TechDocs Architecture](https://backstage.io/docs/features/techdocs/architecture)

Backstage es un framework abierto para construir portales de desarrolladores. Antes de la versión 1.14.3, esta es una vulnerabilidad de omisión de configuración que permite la ejecución de código arbitrario. El paquete @backstage/plugin-techdocs-node utiliza una lista de permitidos para filtrar claves de configuración peligrosas de MkDocs durante el proceso de compilación de la documentación. Una brecha en esta lista de permitidos permite a los atacantes crear un mkdocs.yml que provoca la ejecución de código Python arbitrario, eludiendo completamente los controles de seguridad de TechDocs. Este problema ha sido parcheado en la versión 1.14.3.