AIKIDO-2026-756582
nostr-sdk is vulnerable to Insertion of Sensitive Information into Log File
55
CVE Score
Medium
Insertion of Sensitive Information into Log File
TL;DR
Several NIP-46 remote-signer types expose their underlying debug formatting through the generated bindings, even though their fields hold connection credentials and request parameters. Reading debugDescription of these objects, or letting them reach logs, tracing spans, or error reports, exposes the NIP-46 connection secret and request contents. Anyone able to read those outputs can recover the credential and impersonate the signer connection. The fix redacts credentials and plaintext fields in the debug output while preserving non-sensitive structure.
How do I fix this?
Upgrade the nostr-sdk library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application includes the debugDescription of NIP-46 connect types in logs, tracing, or error reports.
Package
Versions
0.0.1 - 0.44.7
Fixed in 0.44.8Background info
nostr-sdk is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.1 - 0.44.7.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.