https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:25:56 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06110 bdu:2026-06110 https://cve.radiocsirt.org/vuln/bdu:2026-06110 https://cve.radiocsirt.org/vuln/euvd-2026-251600 EUVD-2026-251600 https://cve.radiocsirt.org/vuln/euvd-2026-251600 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58160 <p>tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.</p> <p>tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-58160 https://cve.radiocsirt.org/vuln/ghsa-xwfj-jgwm-7wp5 <p><strong>Affected:</strong> crates.io: tracing-subscriber</p> <p>### Impact</p> <p>Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:</p> <p>- Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation</p> <p>In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.</p> <p>### Patches</p> <p>`tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.</p> <p>### Workarounds</p> <p>Avoid printing logs to terminal emulators without escaping ANSI control sequences.</p> <p>### References</p> <p>https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/</p> <p>### Acknowledgments</p> <p>We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`.</p> <p>If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`.</p> <p><strong>Affected:</strong> crates.io: tracing-subscriber</p> <p>### Impact</p> <p>Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:</p> <p>- Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation</p> <p>In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.</p> <p>### Patches</p> <p>`tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.</p> <p>### Workarounds</p> <p>Avoid printing logs to terminal emulators without escaping ANSI control sequences.</p> <p>### References</p> <p>https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/</p> <p>### Acknowledgments</p> <p>We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`.</p> <p>If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`.</p> https://cve.radiocsirt.org/vuln/ghsa-xwfj-jgwm-7wp5 https://cve.radiocsirt.org/vuln/msrc_cve-2025-58160 msrc_CVE-2025-58160 https://cve.radiocsirt.org/vuln/msrc_cve-2025-58160 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15512-1 <p>bpftop-0.7.1-1.1 on GA media</p> <p>bpftop-0.7.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15512-1 https://cve.radiocsirt.org/vuln/rustsec-2025-0055 <p><strong>Affected:</strong> crates.io: tracing-subscriber</p> <p>Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:</p> <p>- Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation</p> <p>In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.</p> <p>This was patched in [PR #3368](https://github.com/tokio-rs/tracing/pull/3368) to escape ANSI control characters from user input.</p> <p><strong>Affected:</strong> crates.io: tracing-subscriber</p> <p>Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:</p> <p>- Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation</p> <p>In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.</p> <p>This was patched in [PR #3368](https://github.com/tokio-rs/tracing/pull/3368) to escape ANSI control characters from user input.</p> https://cve.radiocsirt.org/vuln/rustsec-2025-0055 https://cve.radiocsirt.org/vuln/suse-su-2025:03082-1 <p>Security update for python-maturin</p> <p>Security update for python-maturin</p> https://cve.radiocsirt.org/vuln/suse-su-2025:03082-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58160 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-tracing-subscriber, Ubuntu:25.10: rust-tracing-subscriber, Ubuntu:26.04:LTS: rust-tracing-subscriber</p> <p>tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-tracing-subscriber, Ubuntu:25.10: rust-tracing-subscriber, Ubuntu:26.04:LTS: rust-tracing-subscriber</p> <p>tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58160