Low
Active Record logging vulnerable to ANSI escape injection
Type: advisorySources: OSV
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-55193
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:13 UTC · Revision 1
Source evidence
Active Record logging vulnerable to ANSI escape injection
core-osv · Original sourcePublished 13 Aug 2025, 22:41 UTC
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
osv:CVE-2025-55193
Complete source record
{
"id": "9b2bb096ecc2fe6ba4a47853034cd7c222898e98382459eb0aad5109b1dd575b",
"url": "https://osv.dev/vulnerability/CVE-2025-55193",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Active Record logging vulnerable to ANSI escape injection",
"summary": "Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.",
"evidence": "osv:CVE-2025-55193",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2025-55193",
"aliases": [
"CVE-2025-55193",
"GHSA-76r7-hhxj-r776"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rails/rails",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ddb56de25997491b57868d3a119b6aa3cd31ad4b"
},
{
"introduced": "fb6c4305939da06efdf2893d99130e7829c53e8b"
},
{
"fixed": "9204eb520c2784ca7a1da9a4884aad21c59088fd"
},
{
"introduced": "dd8f7185faeca6ee968a6e9367f6d8601a83b8db"
},
{
"fixed": "b0c813bc7b61c71dd21ee3a6c6210f6d14030f71"
},
{
"fixed": "3beef20013736fd52c5dcfdf061f7999ba318290"
},
{
"fixed": "568c0bc2f1e74c65d150a84b89a080949bf9eb9b"
},
{
"fixed": "6a944ca4805e72050a0fbb1a461534eb760d3202"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "7.1.5.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "7.2"
},
{
"fixed": "7.2.2.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "8.0"
},
{
"fixed": "8.0.2.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "3beef20013736fd52c5dcfdf061f7999ba318290"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "568c0bc2f1e74c65d150a84b89a080949bf9eb9b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "6a944ca4805e72050a0fbb1a461534eb760d3202"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v7.1.5.1",
"v7.2.2.1",
"v8.0.2",
"v8.0.1",
"v8.0.0",
"v7.2.2",
"v7.1.5",
"v7.2.1",
"v7.1.4",
"v7.2.0.rc1",
"v7.2.0.beta3",
"v7.2.0.beta2",
"v7.2.0.beta1",
"v7.1.3",
"v7.1.2",
"v7.1.1",
"v7.1.0",
"v7.1.0.rc2",
"v7.1.0.rc1",
"v7.1.0.beta1",
"v7.0.0.alpha2",
"v7.0.0.alpha1",
"v6.1.0.rc1",
"v6.0.0.beta2",
"v6.0.0.beta1",
"v5.1.0.beta1",
"v5.0.0.beta4",
"v5.0.0.beta2",
"v5.0.0.beta1",
"v4.2.0.beta1",
"v4.0.0.rc1",
"v4.0.0.beta1",
"v3.2.0.rc1",
"v3.1.0.rc1",
"v3.1.0.beta1",
"v3.0.0.beta3",
"v3.0.0.beta.3",
"v2.0.1",
"v2.0.0",
"v2.0.0_RC2",
"v2.0.0_RC1",
"v2.0.0_PR",
"v1.1.1",
"v1.1.0",
"v1.1.0_RC1",
"v0.14.3",
"v0.14.1",
"v0.13.1",
"v0.13.0",
"v0.12.0",
"v0.11.1",
"v0.11.0",
"v0.10.1",
"v0.10.0",
"v0.9.5",
"v0.9.4.1",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55193.json"
}
}
],
"modified": "2026-10-28T02:30:33.080752686Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55193.json",
"https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776",
"https://nvd.nist.gov/vuln/detail/CVE-2025-55193",
"https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290",
"https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b",
"https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202"
],
"provider_metadata": {
"cwe_ids": [
"CWE-150"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55193.json"
}
},
"related_cves": [
{
"value": "CVE-2025-55193",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499960,
"published_at": "2025-08-13T22:41:41.89+00:00"
}