Tracing logging user input may result in poisoning logs with ANSI escape sequences
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 12 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tokio-rs | tracing | before 0.3.20 | 0.3.20 | Patch available | CNA |
| — | tracing-subscriber (crates.io) | before 0.3.20 | 0.3.20 | Patch available | GHSA-xwfj-jgwm-7wp5 |
- tracing Vendortokio-rs Affected before 0.3.20 Fixed in 0.3.20 Patch available CNA
- tracing-subscriber (crates.io) Vendor— Affected before 0.3.20 Fixed in 0.3.20 Patch available GHSA-xwfj-jgwm-7wp5
Remediation
- Fix · CNA tracing (tokio-rs) Fixed in 0.3.20
- Fix · GHSA-xwfj-jgwm-7wp5 tracing-subscriber (crates.io) Fixed in 0.3.20 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58160
- 2026-10-03 Alias added: GHSA-xwfj-jgwm-7wp5
References
More tokio-rs vulnerabilities
- TI-2024-18146 Mio's tokens for named pipes may be delivered after deregistration CVSS 3.1CRITICAL 9.1
- TI-2026-20650 Bytes is vulnerable to integer overflow in BytesMut::reserve CVSS 4.0MEDIUM 5.5
- TI-2022-02967 DoS in axum-core due to missing request size limit CVSS 3.1HIGH 7.5
- TI-2026-79968 Race condition in Tokio time Interval can cause use-after-free CVSS 4.0MEDIUM 5.8
- TI-2023-08715 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe CVSS 3.1MEDIUM 5.4
- TI-2025-34841 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check CVSS 4.0MEDIUM 5.1
Sources
- CVE-2025-58160 · CVE Program
- CVE-2025-58160 · NVD
- FIRST EPSS
- GHSA-xwfj-jgwm-7wp5 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-58160 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences