{"id":"CVE-2025-55193","aliases":["DEBIAN-CVE-2025-55193","DLA-4416-1","DSA-6090-1","EUVD-2025-24651","GHSA-76r7-hhxj-r776","SUSE-SU-2026:20091-1","SUSE-SU-2026:20093-1","UBUNTU-CVE-2025-55193","openSUSE-SU-2025:15479-1","openSUSE-SU-2026:10343-1","openSUSE-SU-2026:20025-1"],"status":"published","title":"Active Record logging vulnerable to ANSI escape injection","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00641,"percentile":0.51151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-150"],"published":"2025-08-13T22:32:18Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"RubyGems","package":"activerecord","fixed_in":["8.0.2.1","7.2.2.2","7.1.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.7.10+dfsg-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:7.2.2.2+dfsg-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:7.2.2.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activerecord-8.0","fixed_in":["8.0.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.0.2.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2"},{"fixed":"7.2.2.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u2"}]}],"versions":["2:6.1.7.10+dfsg-1~deb12u1","2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.2+dfsg-2~deb13u1"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.2+dfsg-1"}]}],"versions":["2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Debian:11","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0.3.7+dfsg-2+deb11u4"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.0.3.7+dfsg-2+deb11u1","2:6.0.3.7+dfsg-2+deb11u2","2:6.0.3.7+dfsg-2+deb11u3"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u2"}]}],"versions":["2:6.1.7.10+dfsg-1~deb12u1","2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.2+dfsg-2~deb13u1"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.0.2.1"}]}],"versions":["8.0.0","8.0.0.1","8.0.1","8.0.2"]},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2"},{"fixed":"7.2.2.2"}]}],"versions":["7.2.0","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1"]},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5.2"}]}],"versions":["1.0.0","1.1.0","1.10.0","1.10.1","1.11.0","1.11.1","1.12.1","1.12.2","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.14.3","1.14.4","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0+git.1742310530.bfcd0e2c-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0+git.1742310530.bfcd0e2c-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activerecord-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activerecord-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.3-1.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hawk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0+git.1742310530.bfcd0e2c-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"rails","product":"rails"}],"references":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55193","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2025-55193.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-76r7-hhxj-r776"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55193.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-55193","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620091-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230275","tags":["report"]},{"url":"https://bugzilla.suse.com/1247899","tags":["report"]},{"url":"https://bugzilla.suse.com/1248100","tags":["report"]},{"url":"https://bugzilla.suse.com/1251939","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620093-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-55193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55193","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54133","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-55193","title":"Active Record logging vulnerable to ANSI escape injection","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","status":"published","published":"2025-08-13T22:41:41.89Z","modified":"2025-08-14T14:51:11.284Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-24651","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","status":"published","published":"2025-08-13T22:41:41Z","modified":"2025-08-14T14:51:11Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T20:31:57.953552Z"}],"ghsa":[{"id":"GHSA-76r7-hhxj-r776","title":"Active Record logging vulnerable to ANSI escape injection","description":"This vulnerability has been assigned the CVE identifier CVE-2025-55193\n\n### Impact\nThe ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\n### Credits\n\nThanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability","status":"published","published":"2025-08-13T22:32:18Z","modified":"2025-08-21T21:36:39Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2025-55193","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","status":"published","published":"2025-08-13T23:15:26.237Z","modified":"2026-06-17T09:41:25.953Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:11:23.594522Z"}],"osv":[{"id":"CVE-2025-55193","title":"Active Record logging vulnerable to ANSI escape injection","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","status":"published","published":"2025-08-13T22:41:41.89Z","modified":"2026-10-28T02:30:33.080752686Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-55193","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","status":"published","published":"2025-08-13T23:15:26.237Z","modified":"2026-09-01T20:05:54.63753913Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-76r7-hhxj-r776","title":"Active Record logging vulnerable to ANSI escape injection","description":"This vulnerability has been assigned the CVE identifier CVE-2025-55193\n\n### Impact\nThe ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\n### Credits\n\nThanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability","status":"published","published":"2025-08-13T22:32:18Z","modified":"2026-09-10T03:50:26.794588754Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"UBUNTU-CVE-2025-55193","description":"Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.","status":"published","published":"2025-08-13T23:15:00Z","modified":"2026-10-17T12:58:38.177768195Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DLA-4416-1","title":"rails - security update","status":"published","published":"2025-12-21T00:00:00Z","modified":"2025-12-21T17:14:46.167569Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6090-1","title":"rails - security update","status":"published","published":"2025-12-21T00:00:00Z","modified":"2025-12-21T15:14:54.07983Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15479-1","title":"ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-21T00:00:00Z","modified":"2026-03-23T04:53:50.098985Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:10343-1","title":"ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.494088Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20025-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\n- Bump ruby gem rack to 3.1.18 (bsc#1251939).\n- Bump ruby gem uri to 1.0.4.\n- Fix the mtime in manifest.json (bsc#1230275).\n- Make builds determinitstic (bsc#1230275).\n- Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100).\n- Require openssl explicitly (bsc#1247899).","status":"published","published":"2026-01-13T12:41:42Z","modified":"2026-03-23T04:54:41.428093Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:20091-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\n- Bump ruby gem rack to 3.1.18 (bsc#1251939).\n- Bump ruby gem uri to 1.0.4.\n- Fix the mtime in manifest.json (bsc#1230275).\n- Make builds determinitstic (bsc#1230275).\n- Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100).\n- Require openssl explicitly (bsc#1247899).","status":"published","published":"2026-01-13T12:46:40Z","modified":"2026-03-23T04:52:34.791475Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20093-1","title":"Security update for hawk2","description":"This update for hawk2 fixes the following issues:\n\n- Bump ruby gem rack to 3.1.18 (bsc#1251939).\n- Bump ruby gem uri to 1.0.4.\n- Fix the mtime in manifest.json (bsc#1230275).\n- Make builds determinitstic (bsc#1230275).\n- Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100).\n- Require openssl explicitly (bsc#1247899).","status":"published","published":"2026-01-13T12:43:07Z","modified":"2026-03-23T04:52:34.722401Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}