CVE-2026-29186: backstage Injection

Vulnerability summary

CVE-2026-29186 is a critical (CVSS 9.8) Injection vulnerability in backstage. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.3% of scored vulnerabilities.

Timeline

1. 07-03-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the documentation build process. A gap in this allowlist allows attackers to craft an mkdocs.yml that causes arbitrary Python code execution, completely bypassing TechDocs' security controls. This issue has been patched in version 1.14.3.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
• CWE-791Incomplete Filtering of Special ElementsThe product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.