Is CVE-2025-55285 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-55285 being exploited in the wild.

How severe is CVE-2025-55285?

Low severity, with a CVSS score of 3.1, published 15 August 2025.

Which products and versions are affected?

Backstage Scaffolder Backend Plugin <= 2.1.0; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=2.1.1.

Is there a fix for CVE-2025-55285?

Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-55285 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-55285?

Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-55285: Backstage Scaffolder secret leakage in logs via fetch:template

Q: Is there a fix for CVE-2025-55285?

Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-55285 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-55285?

Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-55285 · Severity: low · CVSS 3.1 · Published 2025-08-15

Backstage is an open-source framework used to build internal developer portals. A logging flaw in the Scaffolder component, which automates software creation, could cause sensitive secrets to be written in plain text to system logs. If exploited, an attacker with access to these logs could obtain credentials or API keys, potentially leading to unauthorized access to other integrated corporate systems.

Technologies: Backstage Scaffolder Backend Plugin, @backstage/plugin-scaffolder-backend (npm). Vendors: Backstage, npm.

Quick answers

Is CVE-2025-55285 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-55285 being exploited in the wild.
How severe is CVE-2025-55285?: Low severity, with a CVSS score of 3.1, published 15 August 2025.
Which products and versions are affected?: Backstage Scaffolder Backend Plugin <= 2.1.0; @backstage/plugin-scaffolder-backend (npm) SEMVER:introduced=0,fixed=2.1.1.
Is there a fix for CVE-2025-55285?: Yes. @backstage/plugin-scaffolder-backend (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55285 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-55285?: Check whether you run Backstage Scaffolder Backend Plugin or @backstage/plugin-scaffolder-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@backstage/plugin-scaffolder-backend (npm): upgrade to 2.1.1 or later
```
npm install @backstage/plugin-scaffolder-backend@2.1.1
```

Technical details

A vulnerability in @backstage/plugin-scaffolder-backend (CWE-532) exists where the fetch:template action performs duplicate logging of input parameters. While one log path is correctly redacted, a second path (specifically involving 'splat' values in the logger transport) emits a pre-redaction copy of the input values. If a template author passes sensitive data via the {{ secrets }} bag to this action, those secrets are written to the Scaffolder or server logs. Exploitation requires the attacker to have high privileges to view logs and for a user to trigger a template that utilizes secrets. The issue is fixed in version 2.1.1 by removing the duplicate log path.

Affected products

Backstage @backstage/plugin-scaffolder-backend <= 2.1.0

Identifiers

CVE-2025-55285
GHSA-3x3q-ghcp-whf7

Timeline

2025-08-15: disclosed
2025-08-15: advisory
2025-08-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.