blog-vi (0.2.6), django-apirouter (>=0.1.0, <=0.2.1) +5 more potentially affected by CVE-2026-61632 via pymdown-extensions (7.1.0)

pymdown-extensions PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - blog-vi 0.2.6 - django-apirouter =0.1.0, =2.1.0, =0.0.4, =0.10.2, =1.4.0, =1.7.0 Source cves: CVE-2026-61632 Source advisory...

mkdocs-techdocs-core (1.5.2) potentially affected by CVE-2026-61632 via pymdown-extensions (10.13.0)

pymdown-extensions PYPI version 10.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core 1.5.2 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

adeso (>=0.0.1, <=0.0.4), arkindex-base-worker (>=0.3.3rc4, <=0.3.3) +4 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.0.1)

pymdown-extensions PYPI version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - adeso =0.0.1, =0.3.3rc4, =1.1.0, =1.1.0, =1.2.1, =1.0.0, =1.0.3 Source cves: CVE-2026-61632 Source advisory:...

mkdocs-techdocs-core (1.6.2) potentially affected by CVE-2026-61632 via pymdown-extensions (10.21.2)

pymdown-extensions PYPI version 10.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core 1.6.2 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

labext-pkg (2.1.1), mkdocs-techdocs-core (>=0.2.3, <=1.0.1) potentially affected by CVE-2026-61632 via pymdown-extensions (9.0.0)

pymdown-extensions PYPI version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - labext-pkg 2.1.1 - mkdocs-techdocs-core =0.2.3, =1.0.1 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

mkdocs-material (8.2.11), mkdocs-techdocs-bandicoot (>=1.1.7, <=1.1.9) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (9.3.0)

pymdown-extensions PYPI version 9.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-material 8.2.11 - mkdocs-techdocs-bandicoot =1.1.7, =1.0.2, =1.1.7 Source cves: CVE-2026-61632 Source advisory:...

bestatic (>=0.0.34, <=0.0.36), mkdocs-techdocs-core (1.6.1) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.19.1)

pymdown-extensions PYPI version 10.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - bestatic =0.0.34, =0.6.42, =0.6.43 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

brigid (>=0.14.0, <=0.16.1), mkdocs-techdocs-core (1.6.0) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.16.1)

pymdown-extensions PYPI version 10.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - brigid =0.14.0, =1.2.5, =1.2.7 Source cves: CVE-2026-61632 Source advisory: OSV:GHSA-9XWG-3R6F-JCX2...

mkdocs-techdocs-core (>=0.0.6, <=0.0.7) potentially affected by CVE-2025-68142 via pymdown-extensions (8.0.0)

pymdown-extensions PYPI version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core =0.0.6, =0.0.7 Source cves: CVE-2025-68142 Source advisory: OSV:PYSEC-2026-1825...

labext-pkg (2.1.1), mkdocs-techdocs-core (>=0.2.3, <=1.0.1) potentially affected by CVE-2025-68142 via pymdown-extensions (9.0.0)

pymdown-extensions PYPI version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - labext-pkg 2.1.1 - mkdocs-techdocs-core =0.2.3, =1.0.1 Source cves: CVE-2025-68142 Source advisory: OSV:PYSEC-2026-1825...

mkdocs-material (8.2.11), mkdocs-techdocs-bandicoot (>=1.1.7, <=1.1.9) +1 more potentially affected by CVE-2025-68142 via pymdown-extensions (9.3.0)

pymdown-extensions PYPI version 9.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-material 8.2.11 - mkdocs-techdocs-bandicoot =1.1.7, =1.0.2, =1.1.7 Source cves: CVE-2025-68142 Source advisory:...

mkdocs-techdocs-core (1.2.0) potentially affected by CVE-2025-68142 via pymdown-extensions (9.9.1)

pymdown-extensions PYPI version 9.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-techdocs-core 1.2.0 Source cves: CVE-2025-68142 Source advisory: OSV:PYSEC-2026-1825...

CVE-2026-29186

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.12-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.6-next.1) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.14.3-next.1)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.10.6-next.1 Source cves: CVE-2026-29186 Source advisory: MEND:CVE-2026-29186...

CVE-2026-29186 @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...

CVE-2026-29186

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...

CVE-2026-29186 @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...

CVE-2026-29186

Summary: CVE-2026-29186 affects Backstage prior to version 1.14.3, due to a gap in the allowlist used by the @backstage/plugin-techdocs-node when processing MkDocs configuration keys. This gap enables an attacker to craft an mkdocs.yml that leads to arbitrary Python code execution, bypassing Tech...

CVE-2026-29186 @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...

CVE-2026-29186: Unrestricted Upload of File with Dangerous Type

Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary code execution. The @backstage/plugin-techdocs-node package uses an allowlist to filter dangerous MkDocs configuration keys during the...