CVE-2025-55193: Active Record logging vulnerable to ANSI escape injection
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Other sources
This vulnerability has been assigned the CVE identifier CVE-2025-55193
Impact The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.
Releases The fixed releases are available at the normal locations.
Credits
Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55193?
CVE-2025-55193 is classified as a medium severity vulnerability due to potential information exposure through unescaped ANSI sequences.
How do I fix CVE-2025-55193?
To fix CVE-2025-55193, upgrade Active Record to version 7.1.5.2, 7.2.2.2, or 8.0.2.1 or later.
What versions of Active Record are affected by CVE-2025-55193?
CVE-2025-55193 affects Active Record versions prior to 7.1.5.2, 7.2.2.2, and 8.0.2.1.
What is the nature of the vulnerability in CVE-2025-55193?
CVE-2025-55193 involves logging IDs without escaping them, potentially leading to the exposure of unescaped ANSI sequences.
Can CVE-2025-55193 lead to data leakage?
Yes, CVE-2025-55193 can lead to data leakage as it may log sensitive information in an unescaped format.