CVE-2025-58160 - CVE House
Back to Database
Status published Low CVE-2025-58160

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Vulnerability Description

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-58160

Credits & Attribution

No credits recorded in the NVD database.

References

More from tokio-rs

View All →
CVE-2025-55159
slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Medium 5.1
CVE-2024-27308
Mio's tokens for named pipes may be delivered after deregistration
High 7.5
CVE-2023-22466
Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe
Medium 5.4
CVE-2022-3212
DoS in axum-core due to missing request size limit
High 7.5

Affected Vendor

Affected Software

tracing
Vulnerable Versions:
< 0.3.20

Timeline

Official Publish: August 29th, 2025
Last Modified: September 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-150

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.