Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 0.0.7
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 0.0.7.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 0.0.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Logging Redactor, a Python library used to mask sensitive data in logs, is affected. When objects with custom string or representation methods are logged, personally identifiable information can appear unmasked in log output, exposing private data that should have been hidden.
Read the original description
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object str or repr methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.
What to do
Upgrade to a fixed version: 0.0.7.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- armurox loggingredactor
fixed in 0.0.7
Evidence 5
- Advisory
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-63417
What does this mean?
When an object's custom __str__ or __repr__ method returns personal data, Logging Redactor did not mask it in the log output. The PII then appears in logs that were meant to have it redacted.Source: github.com
Am I affected, and how do I check?
The advisory's fixed version is 0.0.7, so earlier releases of the armurox loggingredactor Python package are in scope. To check a setup, look at the installed package version, for example with pip show loggingredactor.Source: github.com
What should I do about it?
Upgrade loggingredactor to version 0.0.7 or later, which the vendor says contains the patch. No workaround is listed in the facts.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data