Template Secret leakage in logs in Scaffolder when using `fetch:template`

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the secrets bag could appear in local/server logs when...

CVE-2025-55285

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

CVE-2025-55285

The CVE-2025-55285 issue affects the Backstage scaffolder-backend plugin. Before version 2.1.1, the fetch:template action could duplicate the input log path, causing some secrets passed via the {{ secrets }} bag to be written to logs instead of being redacted. Affected product: @backstage/plugin-...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

OESA-2025-2007 gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...

PT-2025-33503 · Backstage · @Backstage/Plugin-Scaffolder-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-scaffolder-backend versions prior to 2.1.1 Description: The backend for the default Backstage software templates exhibited duplicate logging of input values in the fetch:template action within the Scaffolder. This resulted i...

Linux Distros Unpatched Vulnerability : CVE-2024-37280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of passthrough type. Under certain...

Malicious code in prmr-mgc-template (npm)

The package prmr-mgc-template was found to contain malicious code...

Malicious code in generator-bot-template-generator (npm)

The package generator-bot-template-generator was found to contain malicious code...

Malicious code in k8s-template-validator (npm)

The package k8s-template-validator was found to contain malicious code...

Malicious code in orderly-js-sdk-nextjs-template (npm)

The package orderly-js-sdk-nextjs-template was found to contain malicious code...

Malicious code in @zalastax/nolb-cra-template-t (npm)

The package @zalastax/nolb-cra-template-t was found to contain malicious code...

Malicious code in ganescha-template (npm)

The package ganescha-template was found to contain malicious code...

Malicious code in @zalastax/nolb-cra-template-k (npm)

The package @zalastax/nolb-cra-template-k was found to contain malicious code...

MAL-2025-28260 Malicious code in op-template-engine (npm)

The package op-template-engine was found to contain malicious code...

MAL-2025-34097 Malicious code in string-template-extractor (npm)

The package string-template-extractor was found to contain malicious code...

MAL-2025-15297 Malicious code in babel-plugin-transform-inject-template (npm)

The package babel-plugin-transform-inject-template was found to contain malicious code...

Malicious code in string-template-extractor (npm)

The package string-template-extractor was found to contain malicious code...