GHSA-3x3q-ghcp-whf7 CVE-2025-55285

Template Secret leakage in logs in Scaffolder when using `fetch:template`

Low npm

Severity: 2.6 / 10; Low · CVSS 3.1
Exploit chance (EPSS): 0.24%; Chance of exploitation in the next 30 days. Higher than 15.56% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-532 Insertion of Sensitive Information into Log File
Fix: 2.1.1; Upgrade @backstage/plugin-scaffolder-backend to this version or later

Description

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the {{ secrets }} bag could appear in local/server logs when the action ran. Exploitation requires use of the secrets argument and access to Scaffolder/build logs; integrity and availability are unaffected.

Fix: upgrade to 2.1.1, which removes the duplicate log path and ensures secrets are redacted.
Mitigation: avoid passing {{ secrets }} to fetch:template if upgrade is not possible.

Open an issue in the Backstage repository

Visit our Discord, linked to in Backstage README

Affected versions

npm

Package	Vulnerable	Fixed in
@backstage/plugin-scaffolder-backend	`< 2.1.1`	`2.1.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@backstage/plugin-scaffolder-backend npm → `2.1.1`

npm

npm install @backstage/plugin-scaffolder-backend@2.1.1

yarn

yarn add @backstage/plugin-scaffolder-backend@2.1.1

pnpm

pnpm add @backstage/plugin-scaffolder-backend@2.1.1

Severity breakdown

CVSS 3.1 2.6

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Attack vector: Network
Attack complexity: High
Privileges required: High
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: None

Weakness

CWE-532: Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

How to prevent it

Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Distribution: Remove debug log files before deploying the application into production.
Operation: Protect log files against unauthorized read/write.
Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2025-55285

Packages

github.com/backstage/backstage

Timeline

Aug 15, 2025 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-vwp5-f99x-x3rq Backstage has improper input validation in scaffolder task list ordering	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-4xvq-3m68-h444 Backstage has sensitive information exposure in scaffolder task logs	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass	High	Also affects @backstage/plugin-scaffolder-backend
GHSA-95p4-vv4g-jxxm Backstage may expose sensitive information in Scaffolder task failure events	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-g2v8-7jhw-pp8p Backstage: Sensitive information exposure in Scaffolder	Critical	Also affects @backstage/plugin-scaffolder-backend
GHSA-xvgh-hmx8-9xxf Backstage: Improper task state validation in Scaffolder backend	High	Also affects @backstage/plugin-scaffolder-backend
GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-29gx-h2m3-xw44 Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback	Medium	Also affects @backstage/plugin-scaffolder-backend

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor