CVE-2025-55285CWE-532

@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

Low · published August 15, 2025

CVSS v3.1
2.6
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-08-15T17:10Z
EPSS history
Timeline
  • 15 AUG 17:10Z
    @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`
    cvelistv5