GitHub Advisoryadvisory · npm

GHSA-3x3q-ghcp-whf7 Template Secret leakage in logs in Scaffolder when using `fetch:template`

LOW Published 2025-08-15 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-55285
Ecosystem
npm
Packages
@backstage/plugin-scaffolder-backend
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2025-08-15

Affected packages

• npm @backstage/plugin-scaffolder-backend: < 2.1.1 → fixed in 2.1.1

Description

A logging flaw in Backstage Scaffolder’s `fetch:template` action up to `@backstage/plugin-scaffolder-backend` 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the `{{ secrets }}` bag could appear in local/server logs when the action ran. Exploitation requires use of the `secrets` argument and access to Scaffolder/build logs; integrity and availability are unaffected. • Fix: upgrade to `2.1.1`, which removes the duplicate log path and ensures secrets are redacted. • Mitigation: avoid passing `{{ secrets }}` to `fetch:template` if upgrade is not possible. > Open an issue in the Backstage repository > > Visit our Discord, linked to in Backstage README

Related

Alias · CVE (1)

  • CVE-2025-55285 @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References