CVE-2025-55193
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
13/08/2025
Last modified:
14/08/2025
Description
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
References to Advisories, Solutions, and Tools
- https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290
- https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b
- https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202
- https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776