CVE-2026-63417 with a CVSS score of 8.2 is a sensitive information exposure vulnerability in the loggingredactor (pip) package, where PII contained in the str or repr output of non-primitive objects was not redacted before being written to logs. The affected component is the library's log redaction logic for custom string representations. An attacker does not need to execute code or interact with a user; the condition is that an application using the affected library logs non-primitive objects whose custom str or repr methods include personal data. Because the redactor fails to remove that data, PII can appear in log records that were intended to be sanitized, allowing anyone with access to the affected log output to read the exposed information. The business impact is an increased risk of privacy breaches, regulatory noncompliance, customer trust loss, and potential legal or contractual consequences when personal data is retained in logs beyond the intended scope.
We recommend you to update loggingredactor to version 0.0.7 or later.[/subscribe_to_unlock_form]
CVE-2026-63417 with a CVSS score of 8.2 is a sensitive information exposure vulnerability in the loggingredactor (pip) package, where PII contained in the str or repr output of non-primitive objects was not redacted before being written to logs. The affected component is the library's log redaction logic for custom string representations. An attacker does not need to execute code or interact with a user; the condition is that an application using the affected library logs non-primitive objects whose custom str or repr methods include personal data. Because the redactor fails to remove that data, PII can appear in log records that were intended to be sanitized, allowing anyone with access to the affected log output to read the exposed information. The business impact is an increased risk of privacy breaches, regulatory noncompliance, customer trust loss, and potential legal or contractual consequences when personal data is retained in logs beyond the intended scope.
We recommend you to update loggingredactor to version 0.0.7 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]