Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-30089
CVE-2025-30089:
Rust vulnerability analysis and mitigation
Overview
gurk (aka gurk-rs) through version 0.6.3 contains a vulnerability related to improper handling of ANSI escape sequences. The vulnerability was disclosed on March 16, 2025, and has been assigned identifier CVE-2025-30089. This security flaw affects the gurk-rs messaging client application (NVD, MITRE).
Technical details
The vulnerability stems from improper neutralization of ANSI escape sequences in received messages (CWE-150). When messages containing unsanitized ANSI escape sequences are rendered by the client, they are processed directly by the terminal without proper filtering. This implementation allows for various terminal control sequences to be executed, including color changes, cursor movement, terminal clearing, and window title modifications (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L (NVD).
Impact
The primary impact of this vulnerability is the potential defacement of the terminal interface, making the CLI completely unusable. Different terminals may be affected differently based on their implementation of terminal control sequences. While remote code execution might be theoretically possible depending on the terminal used, this impact has not been confirmed (GitHub Issue).
Mitigation and workarounds
The recommended mitigation is to sanitize untrusted data, particularly received messages, before rendering them to the terminal. This could be implemented by filtering the \x1b character or implementing more complex filtering mechanisms that preserve Unicode and emoji rendering capabilities (GitHub Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management