Rails CVE-2025-55193 and CVE-2025-24293 | Greg Molnar

We had two news Rails CVE published recently and both of them looks interesting from an exploitation stand point so I wanted to explore what could be achieved with them. Let’s look into CVE-2025-55193 first. It is an ANSI escape injection vulnerability in Active Record’s logging mechanism. First of all, let me explain what an ANSI escape injection is. When you terminal prints text, there are special escape characters that can be used to colorize the text or change the terminal’s behavior. Now this escape characters can be used to execute arbitrary commands as well in some terminals, so if you display an malicious string, it can be exploited.