AIKIDO-2026-293011
launchdarkly/server-sdk is vulnerable to Information Exposure
25
Low Risk
This Affects:
launchdarkly/server-sdkTL;DR
The SDK automatically redacts the attribute values of anonymous contexts before sending analytics events, but the serializer applies this redaction only to feature events. custom (track) and migration_op events still serialize the full set of anonymous context attribute values instead of omitting them. This exposes anonymous context attribute data, which often holds personal or otherwise sensitive information, inside analytics event payloads sent to LaunchDarkly. The fix extends anonymous-attribute redaction in EventSerializer::filterEvent to custom and migration_op events.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application sends custom or migration operation events for anonymous contexts that carry attributes.
Background info
launchdarkly/server-sdk is vulnerable to Information Exposure in versions 6.1.0 - 6.8.1.
How to fix this
Upgrade the launchdarkly/server-sdk and/or the launchdarkly/launchdarkly-php library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant