Update Rust crate tracing-subscriber to v0.3.23 [SECURITY] by renovate-bot · Pull Request #160069 · rust-lang/rust

renovate-bot · 2026-07-28T11:53:37Z

This PR contains the following updates:

Package	Type	Update	Change
tracing-subscriber (source)	dependencies	patch	`0.3.22` → `0.3.23`
tracing-subscriber (source)	dev-dependencies	patch	`0.3.22` → `0.3.23`

Tracing logging user input may result in poisoning logs with ANSI escape sequences

CVE-2025-58160 / GHSA-xwfj-jgwm-7wp5

More information

Details

Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

Manipulate terminal title bars
Clear screens or modify terminal display
Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

Patches

tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

Workarounds

Avoid printing logs to terminal emulators without escaping ANSI control sequences.

References

https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/

Acknowledgments

We would like to thank zefr0x who responsibly reported the issue at security@tokio.rs.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at security@tokio.rs.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

tokio-rs/tracing (tracing-subscriber)

`v0.3.23`: tracing-subscriber 0.3.23

Compare Source

Fixed

Allow ansi sanitization to be disabled (#&rust-lang/rust#8203;3484)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

rustbot · 2026-07-28T11:53:40Z

These commits modify the Cargo.lock file. Unintentional changes to Cargo.lock can be introduced when switching branches and rebasing PRs.

If this was unintentional then you should revert the changes before this PR is merged.
Otherwise, you can ignore this comment.

rustbot · 2026-07-28T11:53:43Z

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @Mark-Simulacrum

jieyouxu

r? me @bors r+ rollup

View changes since this review

rust-bors · 2026-07-28T12:33:03Z

📌 Commit 32246e5 has been approved by jieyouxu

It is now in the queue for this repository.

…g-subscriber-vulnerability, r=jieyouxu Update Rust crate tracing-subscriber to v0.3.23 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.22` → `0.3.23` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.22` → `0.3.23` | --- ### Tracing logging user input may result in poisoning logs with ANSI escape sequences [CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) <details> <summary>More information</summary> #### Details ##### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator. ##### Patches `tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal. ##### Workarounds Avoid printing logs to terminal emulators without escaping ANSI control sequences. ##### References https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/ ##### Acknowledgments We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`. If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) - [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html) - [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>tokio-rs/tracing (tracing-subscriber)</summary> ### [`v0.3.23`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.23): tracing-subscriber 0.3.23 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.22...tracing-subscriber-0.3.23) ##### Fixed - Allow ansi sanitization to be disabled ([#&rust-lang#8203;3484]) [#&rust-lang#8203;3484]: https://redirect.github.com/tokio-rs/tracing/pull/3484 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).

…uwer Rollup of 14 pull requests Successful merges: - #159990 (Many "predicate"-to-"clause" renamings) - #159665 (Replace most `Ty::new_fn_def` calls with `type_of` queries directly) - #159687 (rustdoc: Set tracing max_level_info when debug-logging is false) - #160065 (Distinguish the dep-graph index space from the live node count) - #159978 (run intrinsic-test by default on x86_64-gnu) - #160008 (Avoid stale closure recovery state across statements) - #160027 (Add regression test for #132767) - #160030 (Update `browser-ui-test` version to `0.25.0`) - #160046 (Improve consistency of attribute error messages (part 2)) - #160056 (Fix associated function suggestion for generic ADTs) - #160069 (Update Rust crate tracing-subscriber to v0.3.23 [SECURITY]) - #160071 (sanitize_standard_fds: clarify macos comment) - #160076 (use unstable features when updating dependencies) - #160088 (fix 404 url in src/doc/rustdoc.md)

…g-subscriber-vulnerability, r=jieyouxu Update Rust crate tracing-subscriber to v0.3.23 [SECURITY] This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dependencies | patch | `0.3.22` → `0.3.23` | | [tracing-subscriber](https://tokio.rs) ([source](https://redirect.github.com/tokio-rs/tracing)) | dev-dependencies | patch | `0.3.22` → `0.3.23` | --- ### Tracing logging user input may result in poisoning logs with ANSI escape sequences [CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) / [GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) <details> <summary>More information</summary> #### Details ##### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modify terminal display - Potentially mislead users through terminal manipulation In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator. ##### Patches `tracing-subscriber` version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal. ##### Workarounds Avoid printing logs to terminal emulators without escaping ANSI control sequences. ##### References https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/ ##### Acknowledgments We would like to thank [zefr0x](http://github.com/zefr0x) who responsibly reported the issue at `security@tokio.rs`. If you believe you have found a security vulnerability in any tokio-rs project, please email us at `security@tokio.rs`. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58160](https://nvd.nist.gov/vuln/detail/CVE-2025-58160) - [https://rustsec.org/advisories/RUSTSEC-2025-0055.html](https://rustsec.org/advisories/RUSTSEC-2025-0055.html) - [https://github.com/advisories/GHSA-xwfj-jgwm-7wp5](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xwfj-jgwm-7wp5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>tokio-rs/tracing (tracing-subscriber)</summary> ### [`v0.3.23`](https://redirect.github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.23): tracing-subscriber 0.3.23 [Compare Source](https://redirect.github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.22...tracing-subscriber-0.3.23) ##### Fixed - Allow ansi sanitization to be disabled ([#&rust-lang#8203;3484]) [#&rust-lang#8203;3484]: https://redirect.github.com/tokio-rs/tracing/pull/3484 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).

…uwer Rollup of 21 pull requests Successful merges: - #159990 (Many "predicate"-to-"clause" renamings) - #159665 (Replace most `Ty::new_fn_def` calls with `type_of` queries directly) - #159687 (rustdoc: Set tracing max_level_info when debug-logging is false) - #160057 (refactor(mir-transform): Calculate optimization status inside `run_passes_inner`) - #160060 (codegen: skip stores for entirely-uninit constant aggregate fields, attempt #2) - #160063 (Fix ICE when dumping the dep graph with the parallel frontend) - #160065 (Distinguish the dep-graph index space from the live node count) - #158038 (Split register_tool into register_attribute_tool and register_lint_tool) - #159776 (remove const hack in alloc) - #159978 (run intrinsic-test by default on x86_64-gnu) - #160008 (Avoid stale closure recovery state across statements) - #160027 (Add regression test for #132767) - #160030 (Update `browser-ui-test` version to `0.25.0`) - #160046 (Improve consistency of attribute error messages (part 2)) - #160056 (Fix associated function suggestion for generic ADTs) - #160069 (Update Rust crate tracing-subscriber to v0.3.23 [SECURITY]) - #160071 (sanitize_standard_fds: clarify macos comment) - #160076 (use unstable features when updating dependencies) - #160092 (miri ui tests: don't run native tests on stage 0) - #160093 (Switch cargo assignments to weihanglo) - #160094 (Update assignment for docs)

Update Rust crate tracing-subscriber to v0.3.23 [SECURITY]

32246e5

rustbot added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jul 28, 2026

rustbot assigned Mark-Simulacrum Jul 28, 2026

jieyouxu approved these changes Jul 28, 2026

View reviewed changes

rustbot assigned jieyouxu Jul 28, 2026

rust-bors Bot added the S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. label Jul 28, 2026

rustbot unassigned Mark-Simulacrum Jul 28, 2026

rust-bors Bot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jul 28, 2026

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 6 pull requests #160072

Closed

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 11 pull requests #160080

Closed

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 12 pull requests #160081

Closed

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 11 pull requests #160082

Closed

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 14 pull requests #160089

Closed

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 14 pull requests #160096

Closed

JonathanBrouwer mentioned this pull request Jul 28, 2026

Rollup of 21 pull requests #160102

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Update Rust crate tracing-subscriber to v0.3.23 [SECURITY] - #160069

Update Rust crate tracing-subscriber to v0.3.23 [SECURITY]#160069
renovate-bot wants to merge 1 commit into
rust-lang:mainfrom
renovate-bot:renovate/crate-tracing-subscriber-vulnerability

renovate-bot commented Jul 28, 2026 •

edited by rustbot

Loading

Uh oh!

rustbot commented Jul 28, 2026

Uh oh!

rustbot commented Jul 28, 2026

Uh oh!

jieyouxu left a comment •

edited by rustbot

Loading

Uh oh!

rust-bors Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

renovate-bot commented Jul 28, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Details

Impact

Patches

Workarounds

References

Acknowledgments

Severity

References

Release Notes

v0.3.23: tracing-subscriber 0.3.23

Fixed

Configuration

Uh oh!

rustbot commented Jul 28, 2026

Uh oh!

rustbot commented Jul 28, 2026

Uh oh!

jieyouxu left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rust-bors Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

renovate-bot commented Jul 28, 2026 •

edited by rustbot

Loading

`v0.3.23`: tracing-subscriber 0.3.23

jieyouxu left a comment •

edited by rustbot

Loading