Insertion of Sensitive Information into Log File

Overview @backstage/plugin-scaffolder-backend is a The Backstage backend plugin that helps you create new things Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the fetch:template action, which duplicates logging of the input values. An...

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285

The CVE-2025-55285 issue affects the Backstage scaffolder-backend plugin. Before version 2.1.1, the fetch:template action could duplicate the input log path, causing some secrets passed via the {{ secrets }} bag to be written to logs instead of being redacted. Affected product: @backstage/plugin-...

Backstage log information leakage vulnerability

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A log information disclosure vulnerability exists in versions prior to Backstage 2.1.1, which stems from duplicate logging of input values resulting in some secrets not being edited...

CVE-2025-55285: Insertion of Sensitive Information into Log File

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

WordPress WPExperts Post SMTP plugin authentication bypass vulnerability

WordPress WPExperts Post SMTP plugin is a plugin for optimizing the WordPress email sending process. The main features include custom email services, email logging, DNS authentication and OAuth authorization. An authentication bypass vulnerability exists in the WordPress WPExperts Post SMTP plugi...

Malicious code in frontend-logging (npm)

The package frontend-logging was found to contain malicious code...

Malicious code in shrugging-logging (npm)

The package shrugging-logging was found to contain malicious code...

Malicious code in logging-repository (npm)

The package logging-repository was found to contain malicious code...

Malicious code in @augloop/logging (npm)

The package @augloop/logging was found to contain malicious code...

MAL-2025-25529 Malicious code in logging-repository (npm)

The package logging-repository was found to contain malicious code...

Malicious code in sc.logging (npm)

The package sc.logging was found to contain malicious code...

MAL-2025-20972 Malicious code in frontend-logging (npm)

The package frontend-logging was found to contain malicious code...

MAL-2025-20548 Malicious code in file-logging (npm)

The package file-logging was found to contain malicious code...

MAL-2025-7095 Malicious code in @augloop/logging (npm)

The package @augloop/logging was found to contain malicious code...

MAL-2025-33167 Malicious code in shrugging-logging (npm)

The package shrugging-logging was found to contain malicious code...

Malicious code in file-logging (npm)

The package file-logging was found to contain malicious code...

LLM Coding Integrity Breach

Here's an interesting story about a failure being introduced by LLM-written code. Specifically, the LLM was doing some code refactoring, and when it moved a chunk of code from one file to another it changed a "break" to a "continue." That turned an error logging statement into an infinite loop,...