{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-63417/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:armurox:loggingredactor:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-63417"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["loggingredactor (\u003c 0.0.7)"],"_cs_severities":["high"],"_cs_tags":["sensitive-data-exposure","logging","python","cve-2026-63417"],"_cs_type":"advisory","_cs_vendors":["armurox"],"content_html":"\u003cp\u003eLogging Redactor (loggingredactor) versions prior to 0.0.7 contain a vulnerability (CVE-2026-63417) where Personally Identifiable Information (PII) is not correctly redacted when processed by custom \u003ccode\u003e__str__\u003c/code\u003e and \u003ccode\u003e__repr__\u003c/code\u003e functions for non-primitive Python objects. This flaw causes sensitive information to be written to application log files in cleartext. There are no workarounds available for this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation or accidental trigger of this vulnerability leads to the leakage of PII into application logs. This increases the risk of unauthorized access to sensitive data if log files are stored in insecure locations, exposed through log management systems, or accessible to unauthorized personnel.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eloggingredactor\u003c/code\u003e package to version 0.0.7 or later across all applications and environments.\u003c/li\u003e\n\u003cli\u003eReview existing application logs for potential historical PII exposure if the library was used to handle sensitive data.\u003c/li\u003e\n\u003cli\u003eRotate any credentials or secrets that may have been inadvertently logged while using affected versions of the library.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T22:15:03Z","date_published":"2026-11-09T22:15:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-logging-redactor-pii-leak/","summary":"The loggingredactor library fails to redact PII within custom __str__ and __repr__ methods of non-primitive objects, resulting in the leakage of sensitive data into application logs.","title":"Logging Redactor: PII exposure in logs (CVE-2026-63417)","url":"https://feed.craftedsignal.io/briefs/2026-11-logging-redactor-pii-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-63417","version":"https://jsonfeed.org/version/1.1"}