CVE-2025-55285: @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs
Summary
CVE-2025-55285: Template Secret leakage in logs in Scaffolder when using fetch:template. Affects @backstage/plugin-scaffolder-backend versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-scaffolder-backend is a plugin for Backstage, an open platform for building developer portals. This plugin facilitates the creation and management of templates for scaffolding new projects. It is designed to streamline the development process by providing a structured way to generate code and resources. However, a vulnerability has been identified that affects how sensitive information is logged during the execution of the fetch:template action.
Vulnerability Detail
The vulnerability arises from duplicate logging of input values in the fetch:template action, which leads to improper redaction of secrets. If users do not pass secrets through the ${ secrets.x } syntax to fetch:template, they are not affected. However, for those who do, sensitive information may be exposed in logs, potentially leading to unauthorized access or data leaks.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install @backstage/plugin-scaffolder-backend@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.1
This is the first release that contains the fix.
npm install @backstage/plugin-scaffolder-backend@2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, template authors can avoid using ${ secrets } as an argument to fetch:template. This will prevent sensitive information from being logged until the package can be updated to the patched version.
Conclusion
In summary, CVE-2025-55285 affects the @backstage/plugin-scaffolder-backend plugin by exposing sensitive information in logs due to improper handling of secrets. Users are advised to update to version 2.1.1 or later to mitigate this risk. Until then, a workaround is available to prevent the logging of secrets.
See every vulnerability recorded for @backstage/plugin-scaffolder-backend →
FAQ
CVE-2025-55285 is a vulnerability in the @backstage/plugin-scaffolder-backend that allows for the leakage of sensitive information in logs due to improper handling of secrets.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If an immediate update is not possible, you can implement the workaround by avoiding the use of ${ secrets } in fetch:template calls.
The potential consequences include unauthorized access to sensitive information, which could lead to data breaches or exploitation of the application.
Yes, you can use Vulert, which monitors your project for open-source vulnerabilities in real-time using just your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-scaffolder-backend.
