{"id":"CVE-2026-63417","kind":"vulnerability","aliases":["CVE-2026-63417"],"related":[],"title":"Logging Redactor: custom __str__ and __repr__ output leaks personal data into logs","description":"Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.","summary":"Logging Redactor is a Python library meant to mask sensitive data in logs. Before version 0.0.7, personal data returned by custom __str__ or __repr__ methods on objects was not redacted when those objects were logged, so the values appear in plain text in log files.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["logging","package","pii","python"],"not_affected_if":["library-not-used","no-custom-repr-with-pii"],"how_to_check":"- Check the installed version with `pip show logging-redactor` (package name as listed in the sources; confirm the exact name in your environment).\n- Search your dependency lock file for the package and look for a version below `0.0.7`.\n- Look for code that logs objects with custom __str__ or __repr__ methods that include personal data.","fix":"- Upgrade the Logging Redactor Python package to `0.0.7` or later.","status":"open","published_at":"2026-11-03T19:18:09+00:00","first_seen_at":"2026-11-03T19:44:53+00:00","triaged_at":"2026-11-03T19:45:25+00:00","updated_at":"2026-11-03T19:45:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T19:45:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Logging Redactor Python package to `0.0.7` or later.","reach":"local","title":"Logging Redactor: custom __str__ and __repr__ output leaks personal data into logs","impact":"medium","summary":"Logging Redactor is a Python library meant to mask sensitive data in logs. Before version 0.0.7, personal data returned by custom __str__ or __repr__ methods on objects was not redacted when those objects were logged, so the values appear in plain text in log files.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","logging","pii"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Personal data appears in plain text in application log files","analyst_note":"","how_to_check":"- Check the installed version with `pip show logging-redactor` (package name as listed in the sources; confirm the exact name in your environment).\n- Search your dependency lock file for the package and look for a version below `0.0.7`.\n- Look for code that logs objects with custom __str__ or __repr__ methods that include personal data.","plain_action":"","needs_analyst":false,"not_affected_if":["library-not-used","no-custom-repr-with-pii"],"who_is_affected":"Teams that use the Logging Redactor Python library to mask sensitive values in logs and log objects whose __str__ or __repr__ output includes personal data. Applications that do not use this library, or that never log such objects, are not exposed by this flaw. The sources do not say which exact code paths or configurations are required to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4199,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-63417':15A,18A '0.0.7':38B,91C,133C 'appear':61B,118C 'base':81C 'caus':114C 'custom':3A,43B,97C 'cve':13A,16A 'data':10A,33B,40B,78C 'design':74C 'dictionari':87C 'expect':123C 'file':67B 'fix':130C 'identifi':93C 'inform':94C 'issu':128C 'key':88C 'leak':8A 'librari':28B,73C 'log':1A,12A,19B,23B,35B,57B,66B,68C,80C,113C,120C 'mask':31B,125C 'meant':29B 'method':47B,102C 'non':109C 'non-primit':108C 'object':49B,55B,98C,111C 'output':7A 'packag':20B 'pattern':84C 'person':9A,39B,92C 'pii':21B 'plain':63B 'primit':110C 'prior':89C 'python':22B,27B,72C 'redact':52B,76C,105C 'redactor':2A,24B,69C 'regex':83C 'repr':6A,46B,101C 'return':41B,95C 'sensit':32B,77C,115C 'str':4A,44B,99C 'text':64B 'valu':60B,116C 'version':37B,132C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the Logging Redactor Python library to mask sensitive values in logs and log objects whose __str__ or __repr__ output includes personal data. Applications that do not use this library, or that never log such objects, are not exposed by this flaw. The sources do not say which exact code paths or configurations are required to trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","logging","package","pii","python"],"campaign_type":null,"first_public_at":"2026-07-01T05:39:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63417","severity":null,"published_at":"2026-11-03T19:18:09+00:00","modified_at":"2026-11-03T19:18:09+00:00","first_seen_at":"2026-11-03T19:44:53+00:00","fetched_at":"2026-11-03T19:44:53+00:00","note":null}],"documents":[{"id":60210,"url":"https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60211,"url":"https://github.com/armurox/loggingredactor/releases/tag/0.0.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60212,"url":"https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T05:39:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}