Publish GHSA-928r-fm4v-mvrw

Author: advisory-database[bot]

advisories/github-reviewed/2026/03/GHSA-928r-fm4v-mvrw/GHSA-928r-fm4v-mvrw.json

@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-928r-fm4v-mvrw",
+  "modified": "2026-03-05T00:12:07Z",
+  "published": "2026-03-05T00:12:07Z",
+  "aliases": [
+    "CVE-2026-29186"
+  ],
+  "summary": "TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution",
+  "details": "### Impact\nThis is a configuration bypass vulnerability that enables arbitrary code execution. The `@backstage/plugin-techdocs-node` package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. \n\nA gap in this allowlist allows attackers to craft an `mkdocs.yml` that causes arbitrary Python code execution, completely bypassing TechDocs' security controls.     \n\n### Patches\n\nPatched in `@backstage/plugin-techdocs-node` version 1.14.3\n\n### Workarounds\nIf users cannot upgrade immediately:\n\n1. Use Docker mode with restricted access: Configure TechDocs with `runIn: docker` instead of `runIn: local`. This provides container isolation, though it does not fully mitigate the risk.\n2. Restrict repository access: Limit who can modify `mkdocs.yml` files in repositories that TechDocs processes. Only allow trusted contributors.\n3. Manual review: Implement PR review requirements for changes to `mkdocs.yml` files to detect malicious hooks configurations before they are merged.\n4. Downgrade MkDocs: Use MkDocs < 1.4.0 (e.g., 1.3.1) which does not support hooks. Note: This may limit access to newer MkDocs features.\n\nNote: Building documentation in CI/CD pipelines using `@techdocs/cli` does not mitigate this vulnerability, as the CLI uses the same vulnerable `@backstage/plugin-techdocs-node` package.\n\n### Resources\n[MkDocs Hooks Documentation](https://www.mkdocs.org/user-guide/configuration/#hooks)\n[MkDocs 1.4 Release Notes](https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27)\n[TechDocs Architecture](https://backstage.io/docs/features/techdocs/architecture)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@backstage/plugin-techdocs-node"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.14.3"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.14.2"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-928r-fm4v-mvrw"
+    },
+    {
+      "type": "WEB",
+      "url": "https://backstage.io/docs/features/techdocs/architecture"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/backstage/backstage"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mkdocs.org/about/release-notes/#version-14-2022-09-27"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mkdocs.org/user-guide/configuration/#hooks"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434",
+      "CWE-74"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-05T00:12:07Z",
+    "nvd_published_at": null
+  }
+}