CVSS 3.1
2.6 lowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:NCVE-2025-55285
Low (2.6). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in @backstage/plugin-scaffolder-backend 2.1.1.
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWE
- CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3x3q-ghcp-whf7 | npm | @backstage/plugin-scaffolder-backend | <2.1.1 | 2.1.1 |