Vulnerability · Published Nov 3, 2026 · Assigned by GitHub_M

CVE-2026-63417Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

High 8.2

In plain English

A high-severity sensitive data in logs in loggingredactor from armurox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.

Affected products (as reported)

Vendor	Product	Versions
armurox	loggingredactor	< 0.0.7

Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f x_refsource_CONFIRM
https://github.com/armurox/loggingredactor/issues/12 x_refsource_MISC
https://github.com/armurox/loggingredactor/pull/15 x_refsource_MISC
https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b x_refsource_MISC
https://github.com/armurox/loggingredactor/releases/tag/0.0.7 x_refsource_MISC