CVE-2025-55193: Active Record logging vulnerable to ANSI escape injection | LiveThreat CVE Feed — Verisq

Login Request a demo

Low severity · published Aug 13, 2025

CVE-2025-55193

Active Record logging vulnerable to ANSI escape injection

2.7

CVSS

0.6%

EPSS

No

On KEV

Description

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 48% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

RA

>= 0, < 7.1.5.2; >= 7.2, < 7.2.2.2; >= 8.0, < 8.0.2.1 · source: vendor

Affected product

RA

rails

rails

References

https://nvd.nist.gov/vuln/detail/CVE-2025-55193

https://www.cve.org/CVERecord?id=CVE-2025-55193

https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290

https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b

https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202

https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776

More from rails

9.5

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing