Skip to content
OpenAdvisories
Low · 2.3 CVE-2025-58160 EUVD-2025-26382GHSA-xwfj-jgwm-7wp5RUSTSEC-2025-0055

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Published Aug 29, 2025 · Updated Sep 2, 2025 · Assigned by GitHub_M

Vendor: tokio-rs Product: tracing Package: atuin Package: berg Package: buck2 Package: cargo-audit Package: cargo-c Package: kata-containers Package: kata-containers-preview Package: kdash Package: libwasmtime Package: linkerd-extension-init Package: linkerd-network-validator Package: linkerd2 Package: linkerd2-cli Package: linkerd2-controller Package: linkerd2-controller-compat Package: linkerd2-debug Package: linkerd2-metrics-api Package: linkerd2-metrics-api-compat Package: linkerd2-proxy Package: linkerd2-proxy-identity Package: linkerd2-tap Package: linkerd2-tap-compat Package: linkerd2-web Package: mountpoint-s3 Package: mountpoint-s3-compat Package: ntpd-rs Package: oranda Package: parseable Package: pgcat Package: pixi Package: pixi-compat Package: py3-supported-hf-xet Package: py3-supported-uv-build Package: py3-xet-core Package: py3.10-hf-xet Package: py3.10-uv-build Package: py3.10-uv-build-bin Package: py3.11-hf-xet Package: py3.11-uv-build Package: py3.11-uv-build-bin Package: py3.12-hf-xet Package: py3.12-uv-build Package: py3.12-uv-build-bin Package: py3.13-hf-xet Package: py3.13-uv-build Package: py3.13-uv-build-bin Package: qdrant Package: qdrant-oci-compat Package: qdrant-oci-entrypoint Package: rpm-ostree Package: ruff Package: ruff-python-formatter Package: rust Package: rust-analyzer Package: rust-tracing-subscriber Package: rust-tracing-subscriber Package: rustup Package: shadowsocks-rust Package: shadowsocks-rust-sslocal Package: shadowsocks-rust-ssmanager Package: shadowsocks-rust-ssserver Package: shadowsocks-rust-ssservice Package: shadowsocks-rust-ssurl Package: topgrade Package: topgrade-bash-completion Package: topgrade-doc Package: topgrade-fish-completion Package: topgrade-zsh-completion Package: tracing-subscriber Package: trident Package: uv Package: wadm Package: wash Package: wasmcloud Package: wasmtime Package: wasmtime-dev Package: yazi Package: zizmor Ecosystem: Azure Linux Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

Affected products

VendorProductAffectedFixed
tokio-rs tracing < 0.3.20 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rust-tracing-subscriber 0.3.20-1 —
Debian 13 rust-tracing-subscriber No fix yet —
Debian 12 rust-tracing-subscriber No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rust-tracing-subscriber No fix yet —
Ubuntu 26.04 LTS rust-tracing-subscriber No fix yet —
Ubuntu 25.10 rust-tracing-subscriber No fix yet —
Ubuntu 24.04 LTS rust-tracing-subscriber No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 himmelblau 0.7.18+git.0.8485a75-150700.3.6.1 SUSE-SU-2026:1361-1, SUSE-SU-2025:3869-1
SLES 15 SP7 rustup 1.28.2~0-150600.10.13.1 SUSE-SU-2026:2832-1
SLES 15 SP6 rustup 1.28.2~0-150600.10.13.1 SUSE-SU-2026:2832-1
SLES 15 SP5 rustup 1.28.2~0-150400.3.13.1 SUSE-SU-2026:2831-1
SLES 15 SP4 rustup 1.28.2~0-150400.3.13.1 SUSE-SU-2026:2831-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 agama 17+699.92879916c-160000.13.1 SUSE-SU-2026:24236-1
SLES for SAP 16.0 cargo-c 0.10.15-160000.1.1 SUSE-SU-2026:20096-1
SLES for SAP 16.0 glycin-loaders 1.2.1-160000.3.1 SUSE-SU-2026:22302-1
SLES for SAP 16.0 gstreamer-devtools 1.26.7-160000.2.1 SUSE-SU-2026:23572-1
SLES for SAP 16.0 himmelblau 0.9.23+git.0.9776141-160000.1.1 SUSE-SU-2025:21158-1, SUSE-FU-2026:20990-1
SLES for SAP 16.0 loupe 48.2-160000.1.1 SUSE-SU-2026:22380-1
SLES for SAP 16.0 python-maturin 1.8.7-160000.3.1 SUSE-SU-2026:20335-1
SLES for SAP 16.0 python-ruff 0.11.13-160000.3.1 SUSE-SU-2026:23607-1
SLES for SAP 16.0 python-uv 0.7.18-160000.3.1 SUSE-SU-2026:20077-1
SLES for SAP 16.0 rav1e 0.8.1-160000.2.1 SUSE-SU-2026:23567-1
SLES for SAP 16.0 rustup 1.29.1~0-160000.1.1 SUSE-SU-2026:24014-1
SLES for SAP 15 SP6 rustup 1.28.2~0-150600.10.13.1 SUSE-SU-2026:2832-1
SLES for SAP 15 SP5 rustup 1.28.2~0-150400.3.13.1 SUSE-SU-2026:2831-1
SLES for SAP 15 SP4 rustup 1.28.2~0-150400.3.13.1 SUSE-SU-2026:2831-1
SLES 16.0 agama 17+699.92879916c-160000.13.1 SUSE-SU-2026:24236-1
SLES 16.0 cargo-c 0.10.15-160000.1.1 SUSE-SU-2026:20096-1
SLES 16.0 glycin-loaders 1.2.1-160000.3.1 SUSE-SU-2026:22302-1
SLES 16.0 gstreamer-devtools 1.26.7-160000.2.1 SUSE-SU-2026:23572-1
SLES 16.0 himmelblau 0.9.23+git.0.9776141-160000.1.1 SUSE-SU-2025:21158-1, SUSE-FU-2026:20990-1
SLES 16.0 loupe 48.2-160000.1.1 SUSE-SU-2026:22380-1
SLES 16.0 python-maturin 1.8.7-160000.3.1 SUSE-SU-2026:20335-1
SLES 16.0 python-ruff 0.11.13-160000.3.1 SUSE-SU-2026:23607-1
SLES 16.0 python-uv 0.7.18-160000.3.1 SUSE-SU-2026:20077-1
SLES 16.0 rav1e 0.8.1-160000.2.1 SUSE-SU-2026:23567-1
SLES 16.0 rustup 1.29.1~0-160000.1.1 SUSE-SU-2026:24014-1
SLE Micro 6.2 python-maturin 1.8.7-160000.3.1 SUSE-SU-2026:20235-1
SLE HPC 15 SP5 rustup 1.28.2~0-150400.3.13.1 SUSE-SU-2026:2831-1
SLE HPC 15 SP4 rustup 1.28.2~0-150400.3.13.1 SUSE-SU-2026:2831-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed agama 24+0.a836cced5-54.1 openSUSE-SU-2026:11679-1
openSUSE Tumbleweed bpftop 0.7.1-1.1 openSUSE-SU-2025:15512-1
openSUSE Tumbleweed cargo-audit 0.21.2~git0.18e58c2-2.1 openSUSE-SU-2025:15550-1
openSUSE Tumbleweed cargo-c 0.10.3~git0.ee7d7ef-4.1 openSUSE-SU-2025:15551-1
openSUSE Tumbleweed cargo-packaging 1.3.0+0-2.1 openSUSE-SU-2025:15552-1
openSUSE Tumbleweed himmelblau 1.2.2+git.0.2d04bca-1.1 openSUSE-SU-2025:15517-1
openSUSE Tumbleweed mdbook 0.5.4-1.1 openSUSE-SU-2026:12402-1
openSUSE Tumbleweed python-maturin 1.9.4-1.1 openSUSE-SU-2025:15518-1
openSUSE Tumbleweed python-ruff 0.12.11-2.1 openSUSE-SU-2025:15519-1
openSUSE Tumbleweed python-uv 0.8.14-2.1 openSUSE-SU-2025:15514-1
openSUSE Tumbleweed rav1e 0.8.1-2.1 openSUSE-SU-2026:11028-1
openSUSE Tumbleweed rustup 1.28.2~0-2.1 openSUSE-SU-2025:15540-1
openSUSE Leap 16.0 agama 17+699.92879916c-160000.13.1 openSUSE-SU-2026:22075-1
openSUSE Leap 16.0 cargo-c 0.10.15-160000.1.1 openSUSE-SU-2026:20060-1
openSUSE Leap 16.0 glycin-loaders 1.2.1-160000.3.1 openSUSE-SU-2026:21134-1
openSUSE Leap 16.0 gstreamer-devtools 1.26.7-160000.2.1 openSUSE-SU-2026:21689-1
openSUSE Leap 16.0 himmelblau 0.9.23+git.0.9776141-160000.1.1 openSUSE-SU-2025:20114-1, openSUSE-FU-2026:20453-1
openSUSE Leap 16.0 loupe 48.2-160000.1.1 openSUSE-SU-2026:21074-1
openSUSE Leap 16.0 python-maturin 1.8.7-160000.3.1 openSUSE-SU-2026:20180-1
openSUSE Leap 16.0 python-ruff 0.11.13-160000.3.1 openSUSE-SU-2026:21741-1
openSUSE Leap 16.0 python-uv 0.7.18-160000.3.1 openSUSE-SU-2026:20026-1
openSUSE Leap 16.0 rav1e 0.8.1-160000.2.1 openSUSE-SU-2026:21681-1
openSUSE Leap 16.0 rustup 1.29.1~0-160000.1.1 openSUSE-SU-2026:22016-1
openSUSE Leap 15.6 cargo-packaging 1.3.0+0-150600.3.3.1 SUSE-SU-2025:4091-1
openSUSE Leap 15.6 python-maturin 1.4.0-150600.3.9.1 SUSE-SU-2025:03082-1
openSUSE Leap 15.6 rust-bindgen 0.72.0-150600.13.3.1 SUSE-SU-2025:4091-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cargo-c 0.9.32-3.amzn2023.0.4 ALAS2023-2025-1180
Amazon Linux 2023 glycin-loaders 1.1.2-9.amzn2023 ALAS2023-2025-1193
Amazon Linux 2023 loupe 47.4-33.amzn2023 ALAS2023-2025-1192

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kata-containers 3.19.1.kata3-6 —
Azure Linux 3 kata-containers-preview No fix yet —
Azure Linux 3 rpm-ostree 2024.4-8 —
Azure Linux 3 rust 1.75.0-25 —
Azure Linux 3 trident 0.22.0-1 —
Azure Linux 2 (CBL-Mariner) rpm-ostree 2022.1-8 —
Azure Linux 2 (CBL-Mariner) rust No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling atuin 18.8.0-r1 —
Wolfi rolling berg 0.4.11-r2 —
Wolfi rolling buck2 20250401-r4 —
Wolfi rolling cargo-audit 0.21.2-r7 —
Wolfi rolling cargo-c 0.10.15-r1 —
Wolfi rolling kdash 0.6.2-r8 —
Wolfi rolling linkerd-extension-init 0.1.7-r1 —
Wolfi rolling linkerd-network-validator 0.1.4-r1 —
Wolfi rolling linkerd2 +10 25.8.5-r1 —
Wolfi rolling linkerd2-proxy 2.316.0-r1 —
Wolfi rolling mountpoint-s3 +1 1.19.0-r2 —
Wolfi rolling ntpd-rs 1.6.2-r1 —
Wolfi rolling oranda 0.6.5-r10 —
Wolfi rolling parseable 2.4.2-r1 —
Wolfi rolling pgcat 1.2.0-r6 —
Wolfi rolling pixi +1 0.53.0-r1 —
Wolfi rolling py3-xet-core +5 1.1.9-r1 —
Wolfi rolling qdrant +2 1.15.4-r1 —
Wolfi rolling ruff +1 0.12.11-r1 —
Wolfi rolling rust-analyzer 20250825-r1 —
Wolfi rolling rustup 1.28.2-r2 —
Wolfi rolling shadowsocks-rust +5 1.23.5-r3 —
Wolfi rolling topgrade +4 16.0.4-r3 —
Wolfi rolling uv +9 0.8.14-r1 —
Wolfi rolling wadm 0.21.0-r4 —
Wolfi rolling wash 0.39.0-r5 —
Wolfi rolling wasmcloud 1.9.0-r1 —
Wolfi rolling wasmtime +2 36.0.2-r1 —
Wolfi rolling yazi 25.5.31-r3 —
Wolfi rolling zizmor 1.12.1-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io tracing-subscriber < 0.3.20 0.3.20 GHSA-xwfj-jgwm-7wp5
crates.io tracing-subscriber >= 0.0.0-0, < 0.3.20 0.3.20 RUSTSEC-2025-0055

Advisories 46

References