{"id":"EUVD-2025-26382","revision":"4578ac71798244208948c50a5d77d2c2","records":[{"revision":"4578ac71798244208948c50a5d77d2c2","observedAt":"2026-11-03T01:05:03.843+00:00","statement":{"source":"euvd","id":"EUVD-2025-26382","aliases":["CVE-2025-58160","GHSA-xwfj-jgwm-7wp5"],"title":"tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input con…","description":"tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3,"severity":null}],"references":["https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26382","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 29, 2025, 9:28:22 PM","dateUpdated":"Sep 2, 2025, 2:08:42 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:11028-1","title":"librav1e0_8-0.8.1-2.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2026:22075-1","title":"Security update for agama","vulnerabilityIds":["CVE-2025-58160","CVE-2026-25541"]},{"id":"openSUSE-SU-2026:21689-1","title":"Security update for gstreamer-devtools","vulnerabilityIds":["CVE-2025-4574","CVE-2025-58160","CVE-2026-25541","CVE-2026-25727","CVE-2026-72813","CVE-2026-72814"]},{"id":"openSUSE-SU-2026:11679-1","title":"agama-24+0.a836cced5-54.1 on GA media","vulnerabilityIds":["CVE-2025-58160","CVE-2026-25541"]},{"id":"openSUSE-SU-2025:15512-1","title":"bpftop-0.7.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2025:15540-1","title":"rustup-1.28.2~0-2.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2026:22380-1","title":"Security update for loupe","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2026:20180-1","title":"Security update for python-maturin","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2025:15517-1","title":"himmelblau-1.2.2+git.0.2d04bca-1.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2025:20114-1","title":"Security update for himmelblau","vulnerabilityIds":["CVE-2025-58160","CVE-2025-59044"]},{"id":"openSUSE-SU-2025:15518-1","title":"python311-maturin-1.9.4-1.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2026:20096-1","title":"Security update for cargo-c","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"SUSE-SU-2025:3869-1","title":"Security update for himmelblau","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2025:15519-1","title":"python311-ruff-0.12.11-2.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2026:22016-1","title":"Security update for rustup","vulnerabilityIds":["CVE-2024-12224","CVE-2025-58160","CVE-2026-25541","CVE-2026-25727","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662","CVE-2026-45784","CVE-2026-93599","CVE-2026-93600","CVE-2026-93601","CVE-2026-93602"]},{"id":"SUSE-SU-2026:23567-1","title":"Security update for rav1e","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2026:20335-1","title":"Security update for python-maturin","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2026:23572-1","title":"Security update for gstreamer-devtools","vulnerabilityIds":["CVE-2025-4574","CVE-2025-58160","CVE-2026-25541","CVE-2026-25727","CVE-2026-72813","CVE-2026-72814"]},{"id":"SUSE-SU-2026:20077-1","title":"Security update for python-uv","vulnerabilityIds":["CVE-2025-58160","CVE-2025-62518"]},{"id":"SUSE-SU-2025:21158-1","title":"Security update for himmelblau","vulnerabilityIds":["CVE-2025-58160","CVE-2025-59044"]},{"id":"SUSE-SU-2026:23607-1","title":"Security update for python-ruff","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-FU-2026:20990-1","title":"Feature update for himmelblau","vulnerabilityIds":["CVE-2025-54882","CVE-2025-58160","CVE-2026-25727","CVE-2026-31979"]},{"id":"openSUSE-SU-2025:15551-1","title":"cargo-c-0.10.3~git0.ee7d7ef-4.1 on GA media","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"SUSE-SU-2026:1361-1","title":"Security update for himmelblau","vulnerabilityIds":["CVE-2024-11738","CVE-2025-53013","CVE-2025-54882","CVE-2025-58160","CVE-2026-25727","CVE-2026-31979","CVE-2026-34397"]},{"id":"SUSE-SU-2025:03082-1","title":"Security update for python-maturin","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2026:21681-1","title":"Security update for rav1e","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2026:24236-1","title":"Security update for agama","vulnerabilityIds":["CVE-2025-58160","CVE-2026-25541"]},{"id":"SUSE-SU-2026:24014-1","title":"Security update for rustup","vulnerabilityIds":["CVE-2024-12224","CVE-2025-58160","CVE-2026-25541","CVE-2026-25727","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662","CVE-2026-45784","CVE-2026-93599","CVE-2026-93600","CVE-2026-93601","CVE-2026-93602"]},{"id":"openSUSE-SU-2026:21134-1","title":"Security update for glycin-loaders","vulnerabilityIds":["CVE-2025-55159","CVE-2025-58160"]},{"id":"openSUSE-SU-2025-20114-1","title":"Security update for himmelblau","vulnerabilityIds":["CVE-2025-58160","CVE-2025-59044"]},{"id":"openSUSE-SU-2025:15514-1","title":"python311-uv-0.8.14-2.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-FU-2026:20453-1","title":"Feature update for himmelblau","vulnerabilityIds":["CVE-2025-54882","CVE-2025-58160","CVE-2026-25727","CVE-2026-31979"]},{"id":"SUSE-SU-2026:22302-1","title":"Security update for glycin-loaders","vulnerabilityIds":["CVE-2025-55159","CVE-2025-58160"]},{"id":"openSUSE-SU-2025:15550-1","title":"cargo-audit-0.21.2~git0.18e58c2-2.1 on GA media","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"msrc_CVE-2025-58160","title":"Tracing logging user input may result in poisoning logs with ANSI escape sequences","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2025:15552-1","title":"cargo-packaging-1.3.0+0-2.1 on GA media","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2025:4091-1","title":"Security update for cargo-packaging, rust-bindgen","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2026:20026-1","title":"Security update for python-uv","vulnerabilityIds":["CVE-2025-58160","CVE-2025-62518"]},{"id":"openSUSE-SU-2026:21741-1","title":"Security update for python-ruff","vulnerabilityIds":["CVE-2025-58160"]},{"id":"openSUSE-SU-2026:20060-1","title":"Security update for cargo-c","vulnerabilityIds":["CVE-2024-12224","CVE-2025-4574","CVE-2025-58160"]},{"id":"openSUSE-SU-2026:21074-1","title":"Security update for loupe","vulnerabilityIds":["CVE-2025-58160"]},{"id":"SUSE-SU-2026:20235-1","title":"Security update for python-maturin","vulnerabilityIds":["CVE-2025-58160"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-26382","identifiers":["EUVD-2025-26382","CVE-2025-58160","GHSA-xwfj-jgwm-7wp5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}