{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@logtape/syslog/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-54511"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@logtape/syslog"],"_cs_severities":["high"],"_cs_tags":["injection","cve-2026-54511"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe @logtape/syslog library contains two output-encoding vulnerabilities (CVE-2026-54511) affecting deployments where \u003ccode\u003eincludeStructuredData\u003c/code\u003e is set to \u003ccode\u003etrue\u003c/code\u003e. First, the \u003ccode\u003eescapeStructuredDataValue()\u003c/code\u003e function fails to escape C0 control characters (U+0000 - U+001F), including newlines and carriage returns. In environments using TCP syslog with non-transparent framing (RFC 6587), an attacker-controlled log property containing a newline can terminate the current log frame and inject a new, forged syslog record.\u003c/p\u003e\n\u003cp\u003eSecond, the library fails to validate SD-NAME keys according to RFC 5424 specifications. If an application forwards attacker-controlled metadata - such as HTTP headers or user-supplied parameters - as structured data keys, an attacker can inject structural characters (like \u003ccode\u003e]\u003c/code\u003e) to break the log format or cause further injection. These vulnerabilities allow attackers to forge logs, manipulate severity/facility levels, and undermine the integrity of downstream SIEM systems like Splunk or Elastic Stack.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to inject arbitrary log entries into downstream infrastructure. This can be used to forge audit logs, obscure malicious activity, or break log ingestion pipelines. Any organization relying on @logtape/syslog to forward application logs to a centralized collector is at risk if they allow user-controlled input to influence log properties.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate @logtape/syslog to the latest patched version immediately (v1.3.11, v2.0.14, or v2.1.5+).\u003c/li\u003e\n\u003cli\u003eReview applications using the \u003ccode\u003eincludeStructuredData: true\u003c/code\u003e configuration to identify and sanitize any user-controlled input being passed as log properties.\u003c/li\u003e\n\u003cli\u003eAudit downstream logging infrastructure (rsyslog, syslog-ng, SIEM collectors) to ensure they are configured to ignore or sanitize records that do not strictly adhere to expected RFC 5424 structured data formats.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-26T20:21:22Z","date_published":"2026-08-26T20:21:22Z","id":"https://feed.craftedsignal.io/briefs/2026-08-logtape-syslog-injection/","summary":"The @logtape/syslog library is vulnerable to syslog injection via unescaped control characters and unvalidated structured data keys, allowing attackers to forge log records in downstream systems.","title":"Log Injection Vulnerability in @logtape/syslog","url":"https://feed.craftedsignal.io/briefs/2026-08-logtape-syslog-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - @Logtape/Syslog","version":"https://jsonfeed.org/version/1.1"}