ANSI Escape Sequence Injection Vulnerability in Tracing-Subscriber by Tokio
CVE-2025-58160

2.3LOW

Key Information:

Vendor

Tokio-rs

Status
Tracing
Vendor
CVE Published:
29 August 2025

What is CVE-2025-58160?

The tracing-subscriber library, which is essential for logging in Rust applications, was previously susceptible to an ANSI escape sequence injection vulnerability. This flaw enabled attackers to manipulate the terminal output when untrusted user input containing ANSI escape sequences was processed. The potential consequences included alterations to terminal title bars, screen clearing, or misleading terminal effects, ultimately posing risks to user trust and application integrity. The vulnerability was addressed in version 0.3.20, which introduced safeguards via escaping ANSI control characters in terminal outputs. Users are advised to apply the update or avoid exposing logs to terminal environments that do not properly escape these sequences.

Affected Version(s)

tracing < 0.3.20

References

https://github.com/tokio-rs/tracing/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58160 : ANSI Escape Sequence Injection Vulnerability in Tracing-Subscriber by Tokio