Active Record logging vulnerable to ANSI escape injection
This vulnerability has been assigned the CVE identifier CVE-2025-55193 ### Impact The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. ### Releases The fixed releases are available at the normal locations. ### Credits Thanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-55193US | — | — | ||
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escapi… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290WEB
- https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9bWEB
- https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202WEB
- https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2025-55193.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-55193ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan