CVE-2025-55193
Fixed in a distro release EPSS <1%CVSS 2.7
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Products: rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activerecord | 8.0.2.1 |
| RubyGems | activerecord | 7.2.2.2 |
| RubyGems | activerecord | 7.1.5.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | ruby3.2-activerecord | 8.0.2.1-r0 |
| Chainguard | ruby3.3-activerecord | 8.0.2.1-r0 |
| Chainguard | ruby3.4-activerecord | 8.0.2.1-r0 |
| Debian 11 | rails | 2:6.0.3.7+dfsg-2+deb11u4 |
| Debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u2 |
| Debian 13 | rails | 2:7.2.2.2+dfsg-2~deb13u1 |
| Debian 14 | rails | 2:7.2.2.2+dfsg-1 |
| SUSE Linux Enterprise High Availability Extension 16.0 | hawk2 | 2.7.0+git.1742310530.bfcd0e2c-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | hawk2 | 2.7.0+git.1742310530.bfcd0e2c-160000.3.1 |
| Ubuntu 24.04 LTS | rails | no fix |
| Ubuntu 25.10 | rails | no fix |
| Ubuntu 26.04 LTS | rails | no fix |
| Ubuntu 26.10 | rails | no fix |
| Ubuntu Pro 16.04 LTS | rails | no fix |
| Ubuntu Pro 18.04 LTS | rails | no fix |
| Ubuntu Pro 20.04 LTS | rails | no fix |
| Ubuntu Pro 22.04 LTS | rails | no fix |
| Wolfi | ruby3.2-activerecord | 8.0.2.1-r0 |
| Wolfi | ruby3.3-activerecord | 8.0.2.1-r0 |
| Wolfi | ruby3.4-activerecord | 8.0.2.1-r0 |
| openSUSE Leap 16.0 | hawk2 | 2.7.0+git.1742310530.bfcd0e2c-160000.3.1 |
| openSUSE Tumbleweed | rubygem-activerecord-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activerecord-8.0 | 8.0.1-2.1 |