CVE-2025-30089: gurk (aka gurk-rs) mishandles ANSI escape sequences
5.4
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.23068%
CWE
Published
3/17/2025
Updated
3/17/2025
KEV Status
No
Technology
Rust
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gurk | rust | <= 0.6.3 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from improper neutralization of ANSI escape sequences in user-controlled input. Based on standard Rust application structure and the described attack vector (message rendering), the most likely vulnerable components are: 1) The message handling function that receives untrusted input, and 2) The terminal output rendering component that displays content. These would be common locations where raw message data interacts with terminal interfaces without proper sanitization. Confidence is medium due to lack of direct code access, but grounded in the described vulnerability pattern and Rust crate architecture.