ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 on GA media (moderate)

ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 on GA media Announcement ID: openSUSE-SU-2025:15480-1 Rating: moderate Cross-References: CVE-2025-55193 CVSS scores: CVE-2025-55193 SUSE : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2025-55193 SUSE : 5.3...

CVE-2025-55193

A flaw was found in activerecord. The find and similar methods may log unescaped identifiers passed as IDs, including ANSI escape codes. An attacker with the ability to directly observe the application's terminal output can view these unescaped sequences. This allows for the injection of ANSI...

CVE-2025-55193

creationtimestamp| type| source ---|---|--- 2025-08-14 03:02:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwde25ylwn2g 2025-10-29 13:31:08+00:00| seen| https://gist.github.com/omid-storyful/ad62fd00008868617d9703d12aa29478 2025-10-29 13:47:42+00:00| seen|...

CVE-2025-55193

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in...

CVE-2025-55193

Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in...

GHSA-76R7-HHXJ-R776 Active Record logging vulnerable to ANSI escape injection

This vulnerability has been assigned the CVE identifier CVE-2025-55193 Impact The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. Releases The fixed releases are available at the normal locations...