CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`
Attackers with log access can view unredacted secrets passed to the fetch:template action in Backstage scaffolder templates.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-55285?
CVE-2025-55285 is a low-severity vulnerability in backstage, published on 15 Aug 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.
Weakness: CWE-532
Which versions are affected by CVE-2025-55285?
2 open source packages ship an affected version, including @backstage/plugin-scaffolder-backend.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-scaffolder-backend npm | All versions | 2.1.1 |
@backstage/plugin-scaffolder-backend npm | All versions | 2.1.1 |
How do I fix CVE-2025-55285?
Upgrade @backstage/plugin-scaffolder-backend to 2.1.1 or later.
Is CVE-2025-55285 being exploited?
There is no known exploitation of CVE-2025-55285 in the wild and no public exploit code.
Sources
Also known as GHSA-3x3q-ghcp-whf7.