Skip to content
Fencer Vulns
low 2.3

CVE-2025-58160 json

Tracing logging user input may result in poisoning logs with ANSI escape sequences

published 2025-08-29 14 mo ago modified 2026-10-18 21 d ago also GHSA-xwfj-jgwm-7wp5 , RUSTSEC-2025-0055 , EUVD-2025-26382

cvss
2.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

Patch / fix

  • crates.io tracing-subscriber 0.3.20
  • rust-tracing-subscriber Debian 14 0.3.20-1

debian advisories DEBIAN-CVE-2025-58160

  • agama SLES for SAP applications 16.0, SLES 16.0 17+699.92879916c-160000.13.1
  • rustup SLES for SAP applications 16.0, SLES 16.0 1.29.1~0-160000.1.1
  • python-ruff SLES for SAP applications 16.0, SLES 16.0 0.11.13-160000.3.1
  • gstreamer-devtools SLES for SAP applications 16.0, SLES 16.0 1.26.7-160000.2.1
  • rav1e SLES for SAP applications 16.0, SLES 16.0 0.8.1-160000.2.1
  • rustup SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 1.28.2~0-150600.10.13.1
  • rustup SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.28.2~0-150400.3.13.1
  • glycin-loaders SLES for SAP applications 16.0, SLES 16.0 1.2.1-160000.3.1

suse advisories SUSE-SU-2026:24236-1SUSE-SU-2026:24014-1SUSE-SU-2026:23607-1SUSE-SU-2026:23572-1SUSE-SU-2026:23567-1SUSE-SU-2026:2832-1

  • mdbook openSUSE Tumbleweed 0.5.4-1.1
  • agama openSUSE Leap 16.0 17+699.92879916c-160000.13.1
  • rustup openSUSE Leap 16.0 1.29.1~0-160000.1.1
  • agama openSUSE Tumbleweed 24+0.a836cced5-54.1
  • python-ruff openSUSE Leap 16.0 0.11.13-160000.3.1
  • gstreamer-devtools openSUSE Leap 16.0 1.26.7-160000.2.1
  • rav1e openSUSE Leap 16.0 0.8.1-160000.2.1
  • loupe openSUSE Leap 16.0 48.2-160000.1.1

opensuse advisories openSUSE-SU-2026:12402-1openSUSE-SU-2026:22075-1openSUSE-SU-2026:22016-1openSUSE-SU-2026:11679-1openSUSE-SU-2026:21741-1openSUSE-SU-2026:21689-1

  • kata-containers Azure Linux 3.0 3.19.1.kata3-6
  • rpm-ostree Azure Linux 3.0 2024.4-8
  • rust Azure Linux 3.0 1.75.0-25
  • rust Azure Linux 3.0 1.90.0-4
  • rpm-ostree CBL-Mariner 2.0 2022.1-8
  • trident Azure Linux 3.0 0.22.0-1

azure linux advisories AZL-73211AZL-73217AZL-73220AZL-73223AZL-73244AZL-78618

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-58160 updated cvss 3.1

tracing-subscriber: Tracing log pollution

  • Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9, openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-operator-bundle, openshift-sandboxed-containers/osc-must-gather-rhel9, openshift-sandboxed-containers/osc-podvm-builder-rhel9, +2 more Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/log-file-metric-exporter-rhel9, openshift-logging/cluster-logging-operator-bundle Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, openshift-service-mesh/istio-sail-operator-bundle, +2 more Red Hat Discovery 2 discovery/discovery-server-rhel9 Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, firefox, rustfmt, +12 more
    +6 more products
    Red Hat Enterprise Linux 9 ctdb, rust, bootc, cargo, samba, clippy, +50 more Red Hat Enterprise Linux 10 gjs, rust, bootc, samba, firefox, snapshot, +4 more Red Hat OpenShift Container Platform 4 bootupd, conmon-rs, rpm-ostree, rust-bootupd, kata-containers, rpm-ostree-libs, +2 more Red Hat Satellite 6 satellite/iop-advisor-engine-rhel9 Red Hat Trusted Artifact Signer rhtas/tuffer-rhel9, rhtas/tuftool-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
crates.io tracing-subscriber
<0.3.20
>=0.0.0-0, <0.3.20
0.3.20

Affected products

  • tokio-rs tracing

Classification

Weakness
  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.