CVE-2025-58160 Tracing logging user input may result in poisoning logs with ANSI escape sequences
Attackers can inject ANSI escape sequences into logs to manipulate terminal displays and mislead users via the tracing-subscriber library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-58160?
CVE-2025-58160 is a low-severity vulnerability in tokio-rs tracing, published on 29 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.
Weakness: CWE-150
Which versions are affected by CVE-2025-58160?
3 open source packages ship an affected version, including tracing-subscriber.
| Package | Affected | Fixed in |
|---|---|---|
tracing-subscriber crates.io | All versions | 0.3.20 |
tracing-subscriber crates.io | All versions | 0.3.20 |
tracing-subscriber crates.io | From 0.0.0-0 | 0.3.20 |
Linux distribution packages (25)
himmelblau SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 0.7.18+git.0.8485a75-150700.3.6.1 |
loupe SUSE:Linux Enterprise Server 16.0 | All versions | 48.2-160000.1.1 |
python-maturin SUSE:Linux Enterprise Server 16.0 | All versions | 1.8.7-160000.3.1 |
python-ruff SUSE:Linux Enterprise Server 16.0 | All versions | 0.11.13-160000.3.1 |
rav1e SUSE:Linux Enterprise Server 16.0 | All versions | 0.8.1-160000.2.1 |
loupe SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 48.2-160000.1.1 |
python-maturin SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.8.7-160000.3.1 |
python-ruff SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.11.13-160000.3.1 |
rav1e SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.8.1-160000.2.1 |
python-maturin SUSE:Linux Micro 6.2 | All versions | 1.8.7-160000.3.1 |
cargo-packaging openSUSE:Leap 15.6 | All versions | 1.3.0+0-150600.3.3.1 |
python-maturin openSUSE:Leap 15.6 | All versions | 1.4.0-150600.3.9.1 |
rust-bindgen openSUSE:Leap 15.6 | All versions | 0.72.0-150600.13.3.1 |
loupe openSUSE:Leap 16.0 | All versions | 48.2-160000.1.1 |
python-maturin openSUSE:Leap 16.0 | All versions | 1.8.7-160000.3.1 |
python-ruff openSUSE:Leap 16.0 | All versions | 0.11.13-160000.3.1 |
rav1e openSUSE:Leap 16.0 | All versions | 0.8.1-160000.2.1 |
bpftop openSUSE:Tumbleweed | All versions | 0.7.1-1.1 |
cargo-packaging openSUSE:Tumbleweed | All versions | 1.3.0+0-2.1 |
himmelblau openSUSE:Tumbleweed | All versions | 1.2.2+git.0.2d04bca-1.1 |
python-maturin openSUSE:Tumbleweed | All versions | 1.9.4-1.1 |
python-ruff openSUSE:Tumbleweed | All versions | 0.12.11-2.1 |
python-uv openSUSE:Tumbleweed | All versions | 0.8.14-2.1 |
rav1e openSUSE:Tumbleweed | All versions | 0.8.1-2.1 |
rustup openSUSE:Tumbleweed | All versions | 1.28.2~0-2.1 |
How do I fix CVE-2025-58160?
Upgrade tracing-subscriber to 0.3.20 or later.
Is CVE-2025-58160 being exploited?
There is no known exploitation of CVE-2025-58160 in the wild and no public exploit code.
Sources
Also known as AZL-73211, AZL-73217, AZL-73220, AZL-73223, AZL-73244, AZL-73247 and 38 more.