CVE-2025-55285: Template Secret leakage in logs in Scaffolder when using `fetch:template`
2.6
Basic Information
Technical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend | npm | <= 2.1.0 | 2.1.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability is a secret leakage issue in the logging mechanism of the Scaffolder backend plugin in Backstage. The root cause is the log method in the BackstageLoggerTransport class, which was logging extra parameters (splat) that could contain secrets. The provided patch c371f6fe12371de31dca537510e6653e287cdc2e directly addresses this by removing the logging of the splat parameter. Therefore, the BackstageLoggerTransport.log function is the vulnerable function. During exploitation, any action that triggers logging through this transport with secrets in the parameters would cause this function to appear in a profiler's stack trace, and the logs would contain the leaked secrets. The fix prevents this by only logging the main message and not the additional, potentially sensitive, data.