Tracing logging user input may result in poisoning logs with ANSI escape sequences

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-58160 · Microsoft / collected KEV context

EUVD-2025-26382

GHSA-xwfj-jgwm-7wp5

RUSTSEC-2025-0055

cve-program · CVE-2025-58160

• https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5

euvd · EUVD-2025-26382

• https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5

nvd · CVE-2025-58160

• https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5

osv · GHSA-xwfj-jgwm-7wp5

• https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5
• https://nvd.nist.gov/vuln/detail/CVE-2025-58160
• https://github.com/tokio-rs/tracing
• https://rustsec.org/advisories/RUSTSEC-2025-0055.html

osv · RUSTSEC-2025-0055

• https://crates.io/crates/tracing-subscriber
• https://rustsec.org/advisories/RUSTSEC-2025-0055.html
• https://github.com/tokio-rs/tracing/pull/3368

• tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input con… · Advisory content revised · 7 Nov 2026