Every CVE Search/ Get API key

CVE-2025-55193

Active Record logging vulnerable to ANSI escape injection

2.7 LowFix available

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.64%Up 0.6 points since Aug 14, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.7

Active Record logging vulnerable to ANSI escape injection

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Record
CVE-2025-55193
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Weakness
CWE-150
Updated
2026-11-02
EUVDEUVD-2025-24651 2.7

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Record
EUVD-2025-24651
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-76r7-hhxj-r776 5.3

Active Record logging vulnerable to ANSI escape injection

This vulnerability has been assigned the CVE identifier CVE-2025-55193

Impact

The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

Releases

The fixed releases are available at the normal locations.

Credits

Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability

Record
GHSA-76r7-hhxj-r776
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-150
Updated
2026-11-02
NVD 2.7

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Record
CVE-2025-55193
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-150
Updated
2026-11-02
OSV 2.7

Active Record logging vulnerable to ANSI escape injection

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Record
CVE-2025-55193
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Weakness
CWE-150
Updated
2026-11-02
OSVDEBIAN-CVE-2025-55193 2.7

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Record
DEBIAN-CVE-2025-55193
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-76r7-hhxj-r776 5.3

Active Record logging vulnerable to ANSI escape injection

This vulnerability has been assigned the CVE identifier CVE-2025-55193

Impact

The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

Releases

The fixed releases are available at the normal locations.

Credits

Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability

Record
GHSA-76r7-hhxj-r776
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-150
Updated
2026-11-02
OSVUBUNTU-CVE-2025-55193 2.7

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Record
UBUNTU-CVE-2025-55193
CVSS 4.0
2.7 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Updated
2026-11-02
OSVopenSUSE-SU-2025:15479-1 No score

ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15479-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10343-1 No score

ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10343-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20025-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • Bump ruby gem rack to 3.1.18 (bsc#1251939).
  • Bump ruby gem uri to 1.0.4.
  • Fix the mtime in manifest.json (bsc#1230275).
  • Make builds determinitstic (bsc#1230275).
  • Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100).
  • Require openssl explicitly (bsc#1247899).
Record
openSUSE-SU-2026:20025-1
Updated
2026-11-02
OSVSUSE-SU-2026:20091-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • Bump ruby gem rack to 3.1.18 (bsc#1251939).
  • Bump ruby gem uri to 1.0.4.
  • Fix the mtime in manifest.json (bsc#1230275).
  • Make builds determinitstic (bsc#1230275).
  • Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100).
  • Require openssl explicitly (bsc#1247899).
Record
SUSE-SU-2026:20091-1
Updated
2026-11-02
OSVSUSE-SU-2026:20093-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • Bump ruby gem rack to 3.1.18 (bsc#1251939).
  • Bump ruby gem uri to 1.0.4.
  • Fix the mtime in manifest.json (bsc#1230275).
  • Make builds determinitstic (bsc#1230275).
  • Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100).
  • Require openssl explicitly (bsc#1247899).
Record
SUSE-SU-2026:20093-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activerecord
RubyGems
 8.0 up to 8.0.2.1
8.0.2.1
activerecord
RubyGems
 7.2 up to 7.2.2.2
7.2.2.2
activerecord
RubyGems
 before 7.1.5.2
7.1.5.2
rails
Debian:12
 before 2:6.1.7.10+dfsg-1~deb12u2, plus listed versions
2:6.1.7.10+dfsg-1~deb12u12:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-12
Show 11 moreShow less
2:6.1.7.3+dfsg-132:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u2
rails
Debian:13
 before 2:7.2.2.2+dfsg-2~deb13u1, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-1
2:7.2.2.2+dfsg-2~deb13u1
rails
Debian:14
 before 2:7.2.2.2+dfsg-1, plus listed versions
2:7.2.2.1+dfsg-7
2:7.2.2.2+dfsg-1
rails
Debian:11
From an advisory covering 2 CVEs
 before 2:6.0.3.7+dfsg-2+deb11u4, plus listed versions
2:6.0.3.7+dfsg-22:6.0.3.7+dfsg-2+deb11u12:6.0.3.7+dfsg-2+deb11u22:6.0.3.7+dfsg-2+deb11u3
2:6.0.3.7+dfsg-2+deb11u4
rails
Debian:12
From an advisory covering 2 CVEs
 before 2:6.1.7.10+dfsg-1~deb12u2, plus listed versions
2:6.1.7.10+dfsg-1~deb12u12:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-12
Show 11 moreShow less
2:6.1.7.3+dfsg-132:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u2
rails
Debian:13
From an advisory covering 2 CVEs
 before 2:7.2.2.2+dfsg-2~deb13u1, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-1
2:7.2.2.2+dfsg-2~deb13u1
activerecord
RubyGems
 8.0 up to 8.0.2.1, plus listed versions
8.0.08.0.0.18.0.18.0.2
8.0.2.1
Show 15 moreShow less
Affected packages
PackageAffectedFixed
activerecord
RubyGems
 7.2 up to 7.2.2.2, plus listed versions
7.2.07.2.17.2.1.17.2.1.27.2.27.2.2.1
7.2.2.2
activerecord
RubyGems
 before 7.1.5.2, plus listed versions
1.0.01.1.01.10.01.10.11.11.0
Show 45 moreShow less
1.11.11.12.11.12.21.13.01.13.11.13.21.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.15.41.15.51.15.61.2.01.3.01.4.01.5.01.5.11.6.01.7.01.8.01.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.17
7.1.5.2
hawk2
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 2 CVEs
 before 2.7.0+git.1742310530.bfcd0e2c-160000.3.1
2.7.0+git.1742310530.bfcd0e2c-160000.3.1
hawk2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 2.7.0+git.1742310530.bfcd0e2c-160000.3.1
2.7.0+git.1742310530.bfcd0e2c-160000.3.1
rails
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2
 None known
rails
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2
 None known
rails
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1
 None known
rails
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1
 None known
rails
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3
 None known
rails
Ubuntu:25.10
 All versions, plus listed versions
2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7
 None known
rails
Ubuntu:26.10
 All versions, plus listed versions
2:7.2.3+dfsg-22:7.2.3.2+dfsg-2
 None known
rails
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2
 None known
rubygem-activerecord-8.0
openSUSE:Tumbleweed
 before 8.0.1-2.1
8.0.1-2.1
rubygem-activerecord-8.0
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 8.0.3-1.3
8.0.3-1.3
hawk2
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.7.0+git.1742310530.bfcd0e2c-160000.3.1
2.7.0+git.1742310530.bfcd0e2c-160000.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-55193 is a low vulnerability (CVSS 2.7) in Rails, published August 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in activerecord 8.0.2.1.

References

Show 15 moreShow less
This page doesn't list everything

Left out here: 430 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open