Input Logging Issue in Backstage Plugin by Spotify

CVE-2025-55285

What is CVE-2025-55285?

The Backstage Plugin Scaffolder Backend, which supports software template management for Backstage, has a vulnerability due to improper input logging. In versions before 2.1.1, the fetch:template action may log input values, leading to inadequate redaction of sensitive information like secrets. When ${{ secrets.x }} is not utilized in the fetch:template call, the risk of exposure is mitigated. For secure implementation, Template Authors should avoid using ${{ secrets }} as a parameter with fetch:template. An update to version 2.1.1 addresses this issue.

References