GitHub Advisoryadvisory · RubyGems

GHSA-76r7-hhxj-r776 Active Record logging vulnerable to ANSI escape injection

MEDIUM Published 2025-08-13 Modified 2025-08-21 Official page ↗
Aliases
CVE-2025-55193
Ecosystem
RubyGems
Packages
activerecord
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-150
Reviewed
2025-08-13

Affected packages

• RubyGems activerecord: >= 8.0, < 8.0.2.1 → fixed in 8.0.2.1 • RubyGems activerecord: >= 7.2, < 7.2.2.2 → fixed in 7.2.2.2 • RubyGems activerecord: < 7.1.5.2 → fixed in 7.1.5.2

Description

This vulnerability has been assigned the CVE identifier CVE-2025-55193 Impact The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. Releases The fixed releases are available at the normal locations. Credits Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability

Related

Alias · CVE (1)

  • CVE-2025-55193 Active Record connects classes to relational database tables. vulnerability

Weakness · CWE (1)

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness

References