CVE-2025-55193
published 2025-08-13CVE-2025-55193: Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be…
PriorityP413low2.7CVSS 4.0
AVNACLATNPRNUINVCNVINVANSCNSILSANEUCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.56%
43.5th percentile
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| activerecord_project | activerecord | >= 0 < 7.1.5.2 | 7.1.5.2 |
| activerecord_project | activerecord | >= 7.2 < 7.2.2.2 | 7.2.2.2 |
| activerecord_project | activerecord | >= 8.0 < 8.0.2.1 | 8.0.2.1 |
| debian | rails | < rails 2:6.1.7.10+dfsg-1~deb12u2 (bookworm) | rails 2:6.1.7.10+dfsg-1~deb12u2 (bookworm) |
| rails | rails | — | — |
| rails | rails | — | — |
| rails | rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-2+deb11u4 | 2:6.0.3.7+dfsg-2+deb11u4 |
| rubyonrails | rails | >= 0 < 2:6.1.7.10+dfsg-1~deb12u2 | 2:6.1.7.10+dfsg-1~deb12u2 |
| rubyonrails | rails | >= 0 < 2:7.2.2.2+dfsg-2~deb13u1 | 2:7.2.2.2+dfsg-2~deb13u1 |
| rubyonrails | rails | >= 0 < 2:7.2.2.2+dfsg-1 | 2:7.2.2.2+dfsg-1 |
CVSS provenance
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa2.7LOW
osv2.7LOW
vendor_debian2.7LOW
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
activerecord: Active Record ANSI Injection Vulnerability
vendor_redhat·2025-08-13·CVSS 2.7
CVE-2025-55193 [LOW] CWE-150 activerecord: Active Record ANSI Injection Vulnerability
activerecord: Active Record ANSI Injection Vulnerability
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
A flaw was found in activerecord. The `find` and similar methods may log unescaped identifiers passed as IDs, including ANSI escape codes. An attacker with the ability to directly observe the application's terminal output can view these unescaped sequences. This allows for the injection of ANSI escape codes into the terminal display, leading to visual manipulation of the output.
Mitigation: Mitigation for
Debian
CVE-2025-55193: rails - Active Record connects classes to relational database tables. Prior to versions ...
vendor_debian·2025·CVSS 2.7
CVE-2025-55193 [LOW] CVE-2025-55193: rails - Active Record connects classes to relational database tables. Prior to versions ...
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Scope: local
bookworm: resolved (fixed in 2:6.1.7.10+dfsg-1~deb12u2)
bullseye: resolved (fixed in 2:6.0.3.7+dfsg-2+deb11u4)
forky: resolved (fixed in 2:7.2.2.2+dfsg-1)
sid: resolved (fixed in 2:7.2.2.2+dfsg-1)
trixie: resolved (fixed in 2:7.2.2.2+dfsg-2~deb13u1)
GHSA
Active Record logging vulnerable to ANSI escape injection
ghsa·2025-08-13·CVSS 2.7
CVE-2025-55193 [LOW] CWE-150 Active Record logging vulnerable to ANSI escape injection
Active Record logging vulnerable to ANSI escape injection
This vulnerability has been assigned the CVE identifier CVE-2025-55193
### Impact
The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.
### Releases
The fixed releases are available at the normal locations.
### Credits
Thanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability
OSV
CVE-2025-55193: Active Record connects classes to relational database tables
osv·2025-08-13·CVSS 2.7
CVE-2025-55193 [LOW] CVE-2025-55193: Active Record connects classes to relational database tables
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
OSV
Active Record logging vulnerable to ANSI escape injection
osv·2025-08-13·CVSS 2.7
CVE-2025-55193 [LOW] Active Record logging vulnerable to ANSI escape injection
Active Record logging vulnerable to ANSI escape injection
This vulnerability has been assigned the CVE identifier CVE-2025-55193
### Impact
The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.
### Releases
The fixed releases are available at the normal locations.
### Credits
Thanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9bhttps://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776
2025-08-13
Published