[CVE-2025-55193] ANSI escape injection in Active Record logging

Security Announcements
,
1

This vulnerability has been assigned the CVE identifier CVE-2025-55193

Impact

The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

Releases

The fixed releases are available at the normal locations.

Credits

Thanks to lio346 for reporting this vulnerability

  • CVE-2025-55193
  • GHSA-76r7-hhxj-r776

Versions affected

  • activerecord >= 8.0, < 8.0.2.1 (patched in 8.0.2.1)
  • activerecord >= 7.2, < 7.2.2.2 (patched in 7.2.2.2)
  • activerecord >= 0, < 7.1.5.2 (patched in 7.1.5.2)

Patches