tokio-rs tracing up to 0.3.19 ANSI Escape Sequence control sequence

Summaryinfo

A vulnerability, which was classified as problematic, has been found in tokio-rs tracing up to 0.3.19. The affected element is an unknown function of the component ANSI Escape Sequence Handler. Performing a manipulation results in control sequence. This vulnerability is reported as CVE-2025-58160. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in tokio-rs tracing up to 0.3.19. This affects an unknown functionality of the component ANSI Escape Sequence Handler. The manipulation with an unknown input leads to a control sequence vulnerability. CWE is classifying the issue as CWE-150. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. This is going to have an impact on integrity. The summary by CVE is:

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-58160 since 08/27/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 260431 (Fedora 44 : uv (2025-18feebeaa7)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.3.20 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (260431). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• tokio-rs

Name

• tracing

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.3.7
• 0.3.8
• 0.3.9
• 0.3.10
• 0.3.11
• 0.3.12
• 0.3.13
• 0.3.14
• 0.3.15
• 0.3.16
• 0.3.17
• 0.3.18
• 0.3.19

Website

• Product: https://github.com/tokio-rs/tracing/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion