CVE-2026-29186 is a high severity flaw (CVSS 7.7) in the npm package @backstage/plugin-techdocs-node, used by Backstage to build documentation. A gap in its MkDocs config allowlist lets a crafted mkdocs.yml execute Python code during a build. Upgrade to version 1.14.3.
What's affected
The GitHub advisory lists version 1.14.2 of @backstage/plugin-techdocs-node as affected and 1.14.3 as patched. The NVD text says versions before 1.14.3 are affected, so treat anything older than 1.14.3 as in scope until you have checked the advisory against your exact version.
The advisory also notes that building docs in CI with @techdocs/cli does not avoid the issue, because the CLI uses the same package.
How to check if you're exposed
Find which version of the package your Backstage app resolves:
npm ls @backstage/plugin-techdocs-node
yarn why @backstage/plugin-techdocs-node
Check the backend package of your Backstage instance and any CI job that installs @techdocs/cli. In app-config.yaml, look at techdocs.builder and techdocs.generator.runIn. A value of local means builds run on the host, while docker runs them in a container.
What to do now
- Upgrade
@backstage/plugin-techdocs-nodeto 1.14.3 or later in your Backstage backend, and update@techdocs/cliin any pipeline that builds docs. - Re-run the install and confirm with
npm lsthat no older copy remains in the tree. - If you cannot upgrade yet, the advisory suggests setting
runIn: dockerfor container isolation, though it says this does not fully mitigate the risk. - Limit who can change mkdocs.yml in repositories TechDocs processes, and require pull request review for changes to it.
- The advisory also names using MkDocs older than 1.4.0 as a workaround, which may cost you newer features. Run the free in-browser dependency scan at https://gold.safeguard.sh/scan to see whether the affected package is in your lockfile or SBOM.
Why it matters
The root cause is an incomplete allowlist, which the record files under CWE-434, CWE-74 and CWE-791. TechDocs tries to strip dangerous MkDocs configuration keys before it builds a site. A key that was missing from that list lets a repository author reach code execution, which bypasses the control the allowlist was meant to provide.
The risk depends on who can write documentation sources. In a company where every repository owner is trusted, the exposure is lower. In a setup where many contributors or external parties can edit mkdocs.yml, the build host becomes the target, and builds often run near source code and tokens. The record does not mark this as exploited in the wild, and it is not in the KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does Docker mode make this safe?
The advisory says container isolation helps but does not fully mitigate the risk. Upgrading is the fix.
Do I need to rebuild existing docs?
The advisory does not say. Upgrade first, then review recent changes to mkdocs.yml for anything unexpected.
Sources
Last reviewed: 19 October 2026.
