CVE-2025-55193 Active Record logging vulnerable to ANSI escape injection
Attackers can inject ANSI escape sequences into Active Record logs via database IDs, potentially manipulating terminal output or hiding malicious activity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55193?
CVE-2025-55193 is a low-severity vulnerability in rails, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Weakness: CWE-150
Which versions are affected by CVE-2025-55193?
6 open source packages ship an affected version, including activerecord.
| Package | Affected | Fixed in |
|---|---|---|
activerecord RubyGems | All versions | 7.1.5.2 |
activerecord RubyGems | All versions | 7.1.5.2 |
activerecord RubyGems | From 7.2 | 7.2.2.2 |
activerecord RubyGems | From 7.2 | 7.2.2.2 |
activerecord RubyGems | From 8.0 | 8.0.2.1 |
activerecord RubyGems | From 8.0 | 8.0.2.1 |
Linux distribution packages (1)
rubygem-activerecord-8.0 openSUSE:Tumbleweed | All versions | 8.0.1-2.1 |
How do I fix CVE-2025-55193?
Upgrade activerecord to a fixed version for your release line: 7.1.5.2, 7.2.2.2 or 8.0.2.1.
Is CVE-2025-55193 being exploited?
There is no known exploitation of CVE-2025-55193 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-55193, GHSA-76r7-hhxj-r776, UBUNTU-CVE-2025-55193, openSUSE-SU-2025:15479-1.