CVEvulnerability

CVE-2025-55285

2.6 LOW Published 2025-08-15 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-08-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.6 LOW — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-532

Description

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References