Skip to content
Heist/ feed
Back to feed
Low

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Type: advisorySources: OSV

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-58160
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 22:43 UTC · Revision 1

Source evidence

Tracing logging user input may result in poisoning logs with ANSI escape sequences

core-osv · Original source

Published 29 Aug 2025, 21:28 UTC

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

osv:CVE-2025-58160
Complete source record
{
  "id": "7ed29e1404608fc36ca8c4d0ec7cae9f1bf7487a32eae6c9a187193ee3dcf504",
  "url": "https://osv.dev/vulnerability/CVE-2025-58160",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Tracing logging user input may result in poisoning logs with ANSI escape sequences",
    "summary": "tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.",
    "evidence": "osv:CVE-2025-58160",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2025-58160",
      "aliases": [
        "CVE-2025-58160",
        "GHSA-xwfj-jgwm-7wp5",
        "RUSTSEC-2025-0055"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/tokio-rs/tracing",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4c52ca5266a3920fc5dfeebda2accf15ee7fb278"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.3.20"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.3.20"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "tracing-attributes-0.1.30",
            "tracing-attributes-0.1.29",
            "tracing-core-0.1.34",
            "tracing-mock-0.1.0-beta.1",
            "tracing-journald-0.3.1",
            "tracing-error-0.2.1",
            "tracing-subscriber-0.3.19",
            "tracing-serde-0.2.0",
            "tracing-0.1.41",
            "tracing-attributes-0.1.28",
            "tracing-core-0.1.33",
            "tracing-appender-0.2.3",
            "tracing-subscriber-0.3.18",
            "tracing-log-0.2.0",
            "tracing-log-0.1.4",
            "tracing-0.1.40",
            "tracing-0.1.39",
            "tracing-core-0.1.32",
            "tracing-attributes-0.1.27",
            "tracing-attributes-0.1.26",
            "tracing-attributes-0.1.25",
            "tracing-core-0.1.31",
            "tracing-0.1.38",
            "tracing-attributes-0.1.24",
            "tracing-subscriber-0.3.17",
            "tracing-subscriber-0.3.16",
            "tracing-0.1.37",
            "tracing-attributes-0.1.23",
            "tracing-core-0.1.30",
            "tracing-opentelemetry-0.18.0",
            "tracing-0.1.36",
            "tracing-core-0.1.29",
            "tracing-subscriber-0.3.15",
            "tracing-attributes-0.1.22",
            "tracing-opentelemetry-0.17.4",
            "tracing-subscriber-0.3.14",
            "tracing-subscriber-0.3.13",
            "tracing-subscriber-0.3.12",
            "tracing-core-0.1.28",
            "tracing-0.1.35",
            "tracing-core-0.1.27",
            "tracing-opentelemetry-0.17.3",
            "tracing-attributes-0.1.21",
            "tracing-log-0.1.3",
            "tracing-journald-0.3.0",
            "tracing-0.1.34",
            "tracing-core-0.1.26",
            "tracing-core-0.1.25",
            "tracing-subscriber-0.3.11",
            "tracing-0.1.33",
            "tracing-core-0.1.24",
            "tracing-subscriber-0.3.10",
            "tracing-appender-0.2.2",
            "tracing-journald-0.2.4",
            "tracing-0.1.32",
            "tracing-core-0.1.23",
            "tracing-attributes-0.1.20",
            "tracing-appender-0.2.1",
            "tracing-opentelemetry-0.17.2",
            "tracing-subscriber-0.3.9",
            "tracing-0.1.31",
            "tracing-opentelemetry-0.17.1",
            "tracing-journald-0.2.3",
            "tracing-subscriber-0.3.8",
            "tracing-serde-0.1.3",
            "tracing-0.1.30",
            "tracing-attributes-0.1.19",
            "tracing-core-0.1.22",
            "tracing-opentelemetry-0.17.0",
            "tracing-subscriber-0.3.7",
            "tracing-journald-0.2.2",
            "tracing-subscriber-0.3.6",
            "tracing-journald-0.2.1",
            "tracing-subscriber-0.3.5",
            "tracing-subscriber-0.3.4",
            "tracing-flame-0.2.0",
            "tracing-subscriber-0.3.3",
            "tracing-subscriber-0.3.2",
            "tracing-subscriber-0.3.1",
            "tracing-opentelemetry-0.16.0",
            "tracing-error-0.2.0",
            "tracing-journald-0.2.0",
            "tracing-appender-0.2.0",
            "tracing-subscriber-0.3.0",
            "tracing-0.1.29",
            "tracing-subscriber-0.2.25",
            "tracing-attributes-0.1.18",
            "tracing-attributes-0.1.17",
            "tracing-core-0.1.21",
            "tracing-subscriber-0.2.24",
            "tracing-0.1.28",
            "tracing-subscriber-0.2.23",
            "tracing-0.1.27",
            "tracing-attributes-0.1.16",
            "tracing-subscriber-0.2.22",
            "tracing-subscriber-0.2.21",
            "tracing-core-0.1.20",
            "tracing-subscriber-0.2.20",
            "tracing-core-0.1.19",
            "tracing-opentelemetry-0.15.0",
            "tracing-opentelemetry-0.14.0",
            "tracing-subscriber-0.2.19",
            "tracing-opentelemetry-0.13.0",
            "tracing-subscriber-0.2.18",
            "tracing-0.1.26",
            "tracing-core-0.1.18",
            "tracing-opentelemetry-0.12.0",
            "tracing-subscriber-0.2.17",
            "tracing-attributes-0.1.15",
            "tracing-attributes-0.1.14",
            "tracing-0.1.25",
            "tracing-subscriber-0.2.16",
            "tracing-log-0.1.2",
            "tracing-0.1.24",
            "tracing-attributes-0.1.13",
            "tracing-futures-0.2.5",
            "tracing-0.1.23",
            "tracing-attributes-0.1.12",
            "tracing-opentelemetry-0.11.0",
            "tracing-opentelemetry-0.10.0",
            "tracing-appender-0.1.2",
            "tracing-0.1.22",
            "tracing-opentelemetry-0.9.0",
            "tracing-subscriber-0.2.15",
            "tracing-subscriber-0.2.14",
            "tracing-opentelemetry-0.8.0",
            "tracing-subscriber-0.2.13",
            "tracing-0.1.21",
            "tracing-core-0.1.17",
            "tracing-subscriber-0.2.12",
            "tracing-serde-0.1.2",
            "tracing-core-0.1.16",
            "tracing-0.1.20",
            "tracing-core-0.1.15",
            "tracing-attributes-0.1.11",
            "tracing-opentelemetry-0.7.0",
            "tracing-subscriber-0.2.11",
            "tracing-0.1.19",
            "tracing-attributes-0.1.10",
            "tracing-core-0.1.14",
            "tracing-core-0.1.13",
            "tracing-opentelemetry-0.6.0",
            "tracing-0.1.18",
            "tracing-subscriber-0.2.10",
            "tracing-core-0.1.12",
            "tracing-journald-0.1.0",
            "tracing-subscriber-0.2.9",
            "tracing-0.1.17",
            "tracing-appender-0.1.1",
            "tracing-subscriber-0.2.8",
            "tracing-core-0.1.11",
            "tracing-0.1.16",
            "tracing-attributes-0.1.9",
            "tracing-subscriber-0.2.7",
            "tracing-subscriber-0.2.6",
            "tracing-0.1.15",
            "tracing-opentelemetry-0.5.0",
            "tracing-0.1.14",
            "tracing-attributes-0.1.8",
            "tracing-opentelemetry-0.4.0",
            "tracing-appender-0.1.0",
            "tracing-subscriber/-0.2.5",
            "tracing-futures-0.2.4",
            "tracing-subscriber-0.2.4",
            "tracing-subscriber-0.2.3",
            "tracing-error-0.1.2",
            "tracing-subscriber-0.2.2",
            "tracing-serde-0.1.1",
            "tracing-0.1.13",
            "tracing-attributes-0.1.7",
            "tracing-futures-0.2.3",
            "tracing-core-0.1.10",
            "tracing-futures-0.2.2",
            "tracing-subscriber-0.2.1",
            "tracing-error-0.1.1",
            "tracing-error-0.1.0",
            "tracing-subscriber-0.2.0",
            "tracing-subscriber-0.2.0-alpha.6",
            "tracing-subscriber-0.2.0-alpha.5",
            "tracing-futures-0.2.1",
            "tracing-0.1.12",
            "tracing-subscriber-0.2.0-alpha.4",
            "tracing-subscriber-0.2.0-alpha.3",
            "tracing-core-0.1.9",
            "tracing-0.1.11",
            "tracing-attributes-0.1.6",
            "tracing-core-0.1.8",
            "tracing-subscriber-0.2.0-alpha.2",
            "tracing-futures-0.2.0",
            "tracing-subscriber-0.2.0-alpha.1",
            "tracing-serde-0.1.0",
            "tracing-futures-0.1.1",
            "tracing-log-0.1.1",
            "tracing-subscriber-0.1.5",
            "tracing-0.1.10",
            "tracing-attributes-0.1.5",
            "tracing-core-0.1.7",
            "tracing-futures-0.1.0",
            "tracing-subscriber-0.1.4",
            "tracing-attributes-0.1.4",
            "tracing-subscriber-0.1.3",
            "tracing-0.1.9",
            "tracing-subscriber-0.1.2",
            "tracing-attributes-0.1.3",
            "tracing-core-0.1.6",
            "tracing-subscriber-0.1.1",
            "tracing-fmt-0.1.1",
            "tracing-subscriber-0.1.0",
            "tracing-0.1.8",
            "tracing-log-0.1.0",
            "tracing-log-0.0.1-alpha.2",
            "tracing-subscriber-0.0.1-alpha.4",
            "tracing-0.1.7",
            "tracing-0.1.6",
            "tracing-attributes-0.1.2",
            "tracing-core-0.1.5",
            "tracing-fmt-0.0.1-alpha.3",
            "tracing-0.1.5",
            "tracing-attributes-0.1.1",
            "tracing-core-0.1.4",
            "tracing-0.1.4",
            "tracing-core-0.1.3",
            "tracing-0.1.3",
            "tracing-core-0.1.2",
            "tracing-0.1.2",
            "tracing-core-0.1.1",
            "tracing-0.1.1",
            "tracing-0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58160.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.964127077Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58160.json",
        "https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-58160"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-150"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58160.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-58160",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490639,
  "published_at": "2025-08-29T21:28:22.563+00:00"
}