CVE-2025-55193CWE-150

Active Record logging vulnerable to ANSI escape injection

Low · published August 13, 2025

CVSS v4.0
2.7
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

The record
Technical detail
CVSS v4.0
2.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
EPSS
0.00593 · 47.7th percentile
Weakness
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences
Published
2025-08-13T22:41Z
EPSS history
Timeline
  • 13 AUG 22:41Z
    Active Record logging vulnerable to ANSI escape injection
    cvelistv5