CVE-2025-58160 is a vulnerability classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences) in the tokio-rs tracing framework's tracing-subscriber component. Versions prior to 0.3.20 do not properly escape ANSI escape sequences in untrusted input that is logged and rendered in terminal emulators. This allows an attacker to inject ANSI control sequences that can alter terminal display behavior, such as changing the terminal title or clearing the screen, potentially misleading users. The issue is resolved in version 0.3.20 by implementing proper escaping of ANSI control characters in terminal output.

The vulnerability allows injection of ANSI escape sequences through logged untrusted input, which can manipulate terminal output. This may cause misleading terminal displays, such as altered titles or cleared screens, potentially confusing users. However, it does not lead to code execution or privilege escalation. No known exploits have been reported in the wild.

A fix is available in tracing-subscriber version 0.3.20, which properly escapes ANSI control characters in terminal output. Users should upgrade to version 0.3.20 or later. As a workaround, avoid printing logs containing unescaped ANSI sequences to terminal emulators. No additional actions are required if the fix is applied.