VYPR
← All advisories
Low severityNVD Advisory· Published Aug 29, 2025· Updated Apr 15, 2026

CVE-2025-58160

CVE-2025-58160

Description

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tracing-subscribercrates.io
< 0.3.200.3.20

Affected products

209

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.