PT-2025-35324 · Unknown+2 · Tracing-Subscriber+2
Zefr0X
·
Published
2025-01-01
·
Updated
2026-04-15
·
CVE-2025-58160
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
tracing-subscriber versions prior to 0.3.20
Description
tracing-subscriber was susceptible to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing manipulation of terminal title bars, screen clearing, or modification of the terminal display, potentially misleading users. Security issues in terminal emulators have been found that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.
Recommendations
Update to version 0.3.20 or later to resolve this issue.
As a temporary workaround, avoid printing logs to terminal emulators without escaping ANSI control sequences.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Suse
Tracing-Subscriber