{"id":"CVE-2025-54389","summary":"AIDE improper output neutralization vulnerability","details":"AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE.  An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.","aliases":["GHSA-522j-vvx9-gg28"],"modified":"2026-08-12T15:16:42.370167Z","published":"2025-08-14T15:53:42.393Z","related":["ALSA-2025:14493","ALSA-2025:14573","ALSA-2025:14592","SUSE-SU-2025:20657-1","SUSE-SU-2025:20754-1","openSUSE-SU-2025:15474-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54389.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-117"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/08/14/7"},{"type":"WEB","url":"https://github.com/aide/aide/releases/tag/v0.19.2"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54389.json"},{"type":"ADVISORY","url":"https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54389"},{"type":"FIX","url":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aide/aide","events":[{"introduced":"0"},{"fixed":"09bfeb7f91dacd9834f458f5712dfeac2606fc85"},{"fixed":"64c8f32b0349c33fb8382784af468338078851f9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.19.2"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*"}}],"versions":["v0.19.1","v0.19","v0.18","v0.17.3","v0.17.2","v0.17.1","v0.17","v0.16.2","v0.16.1","v0.16","v0.16rc1","v0.16b1","v0.16a2","v0.16a1","aide.0.15.1.release","aide.0.15.release","aide.0.15.rc1.release","aide.0.14.2.release","aide.0.14.1.release","aide.0.14.release","aide.0.14.rc3.release","aide.0.14.rc2.release","aide.0.14.rc1.release","aide.0.13.1.release","aide.0.13.release","aide.0.13.rc2.release","aide.0.13.rc1.release","aide.0.12.release","aide.0.12.rc2.release","aide.0.12.rc1.release","aide.0.11b.nocurl","aide.0.11a.debian","aide.0.11.release","aide.0.11.rc3.release","aide.0.11.rc2.release","aide.0.11.rc1.release","aide.0.10.release","cs.tut.fi.import"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54389.json","vanir_signatures_modified":"2026-08-12T15:16:42Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"261779942221387741744528656351577757886","length":372},"id":"CVE-2025-54389-19752c2f","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/log.c","function":"vlog_msg"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/util.c"},"deprecated":false,"digest":{"line_hashes":["219969310939578022469415124672863958924","8383232894539403024313836818070380354","182630421573505296901475585551653436937"],"threshold":0.9},"id":"CVE-2025-54389-1e3f3764"},{"deprecated":false,"digest":{"function_hash":"55794243821625097972617268985920308281","length":541},"id":"CVE-2025-54389-37d2217a","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_plain.c","function":"print_line_plain"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/progress.c"},"deprecated":false,"digest":{"line_hashes":["4375002452373743586298526252136583307","188395213136949590638556270045339646889","65194832234447859741658183739205801713","8637981824015377425614850121099569517"],"threshold":0.9},"id":"CVE-2025-54389-3de46fe2"},{"target":{"file":"src/aide.c","function":"main"},"deprecated":false,"digest":{"function_hash":"198811579557739335287334433315733901996","length":7819},"id":"CVE-2025-54389-54ccd775","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/gen_list.c"},"deprecated":false,"digest":{"line_hashes":["335284634807383279335074813953120998196","177118961361541444533407424302098357876","257868992267931165544881117504725595867","303602335762806988954378312130629384454","91010924349317773393834728429319490071","238240958853045584356376505649255298664","31228261770268891529205143806491958085","286367392457327331160148125874761746308","330364306429491725312926014859575518119","159930913487467602980711550006101242423","323119729924798870568940094381484047223","295693680095957417517155330622039125180","110769758807754527596245467151252307548","59090688457368592968703787495297210917","119229394792840509005579734289612689802","322735442333379181224430126390995950986","318478575488481489979038572165400464793","192974506995621064799201211761000814420","205845797378095578713031758362988020340","105747088357940582968501585487897148012","42059008138519268174750517058458178794","336526076824560192493520355501177382053","234939276588295956196410783559061045935","162619626397557863219030315301780651229","320734161775440975610332623187528346976","119443748455219256307975998645845234604","194855882927419798737264756649635451425","233070455439570311944717472471686443969","334888301809777928595378371937208515730","157523302964667002483089760077749299551","143765276019008192053139797265081636176","218533852418358419958214871348427353374","188594270413987407645483085266696580488","129842910668169257463535458750036447079","235580187724982734137349631356622264248","100590457051226491223886803608782790370"],"threshold":0.9},"id":"CVE-2025-54389-5d49a756"},{"deprecated":false,"digest":{"function_hash":"338135522524449318031585266380901935280","length":411},"id":"CVE-2025-54389-73f9a3e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/log.c","function":"log_cached_lines"}},{"deprecated":false,"digest":{"function_hash":"266562129148240571330345034519589663193","length":786},"id":"CVE-2025-54389-8243cc43","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/aide.c","function":"list_attribute"}},{"target":{"file":"src/log.c"},"deprecated":false,"digest":{"line_hashes":["321446449955556137793027364245297616607","57886683748414215693088051290734844783","259259181852801235654647005824753244228","6946507038585145884617931655914341440","52025544032470240288867519059840340829","261637573776289816626402100448516976345","279914730144718222798322210625260311465","231230246650256757683182446112665657421"],"threshold":0.9},"id":"CVE-2025-54389-8c4497bf","signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9"},{"deprecated":false,"digest":{"function_hash":"191748574296115771715887274307526843127","length":233},"id":"CVE-2025-54389-9115a737","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"function":"_print_config_option","file":"src/report_plain.c"}},{"deprecated":false,"digest":{"function_hash":"279023396429004202544889063823748446913","length":372},"id":"CVE-2025-54389-9e6c07d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_plain.c","function":"print_report_dbline_attributes_plain"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_plain.c","function":"_print_attribute"},"deprecated":false,"digest":{"length":1625,"function_hash":"14223983106682782518932967284324373005"},"id":"CVE-2025-54389-a7ebf29d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_plain.c","function":"print_report_diff_attrs_entries_plain"},"deprecated":false,"digest":{"function_hash":"227493422684690079608858075708484687310","length":482},"id":"CVE-2025-54389-ad6d521f"},{"id":"CVE-2025-54389-afa85261","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_json.c","function":"_escape_json_string"},"deprecated":false,"digest":{"function_hash":"35462929557571740097876858128903634945","length":1031}},{"deprecated":false,"digest":{"function_hash":"14665503012700852688941124593788450033","length":2529},"id":"CVE-2025-54389-b5c248f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"function":"print_match","file":"src/gen_list.c"}},{"digest":{"line_hashes":["27566938710558828078804692840243069973","36709232631610830610691208280917128570","84592801557479907180669831877820262283","324186312302912542495254294773137034986","35697026226762641385262713435976632649","88016541376140950326379622705432405935","74587888357910947968037368795697675824","19841063142400024127847436600897591238","8505029830034069674119729448102801877","67148790086732734013358213073989098381","146423123280381720809716148474799472636","53936962350201610227842346324831765556","16940443862599124811288224016107263951","199131974994555581300444407253374746272","150231824329220257761178004264568022036","267726714035155853650350116185958893659","287186295130012682823104182888279733835","184253740828123905231534380119146924427","28738581159752486827710477330247045324","44030863647442414591806344219381120739","172832163039786146022502208337562063260","183826455683110929061902684688037648433","185492878360319403765613817950013931334","121140274458542790356295222515904813500","211708416778960249840961419308883334540","239409885082016694886936119539919901437","42736009325756703776302375119043131204","258946689128775123530920475095243921716","79338546629639573591700846557952153440","50474372490466986616836740158566387390","275356247698085567323125734939792107365","232817231038149047964212036864284980131","10630260699134060414389891240222350392","279868899925446797921904297488535368332","4079802995113080701431192949560784911","111656977387048086632101511053349773340","338769188357947563767114339056658218616","40475670049231960142795690515474529422","231409816595476118526101725249289094010","102200346288543684177935219021660426468","240374105367449130529323130259726835158","239103495224233872548920752104788761407","238588235349852843112205823153452591598","112017089289253453811283481036863842249","105150890947501069419811341114463041486","9500136047740784095386673707534342517","176332724143377462566367614697745704419","43594082854824590049056229863274318863","106808620666042430539213860452473549718","267606739167145498668448639564055188647","102622797885947762587438640388580475428","337608538904066885904295974051590209239","50498798128230919735105507173316247078","328040317844696976093319086857755486082","207979271320360147929849534982596746730","178720704264033428243664204696117121461","69435999247454195578557358950844607462","299351998815401856071657033994180098642","42294556359428388486356489964829860385","266737720762536014955738506236487203444","58199341538737940695541645143000736133","8189849210313263346234000110364047398","258914243305581834046946971946647222609"],"threshold":0.9},"id":"CVE-2025-54389-c153d647","signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_plain.c"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["199123732741854584659446489726586522585","18472054335225614065095622225684455148","249248756691729861506102061091506431884"]},"id":"CVE-2025-54389-c45fec55","signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"include/util.h"},"deprecated":false},{"id":"CVE-2025-54389-d27cc69c","signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/report_json.c"},"deprecated":false,"digest":{"line_hashes":["177215774738047653173561079211238581814","312008598666804022779453855741675680213","220423093042900487685637300839684996000","75784827699696617851460069345444389662","289982916893373588336006469042193850368"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"function":"read_param","file":"src/aide.c"},"deprecated":false,"digest":{"function_hash":"237423921793095404088315266495141730995","length":6540},"id":"CVE-2025-54389-f504ac04"},{"deprecated":false,"digest":{"line_hashes":["102541685375204519714096314688320124830","48905560368753362525598680611605004512","51125731757025889745727295832503550392","72336766724102183854600814729851972860","199027477862024792743276367107484446178","295193633381543753703748838449574302967","70883975583953919438242792255555809963","260261832055611964417406223855021534171","103222947018824182920613449457393841306","25180149855030936234045127833305483643","305600567417426388672355383211650777040","226558339918415702889672479753651324850","50474372490466986616836740158566387390","5211648478984282945408038634249269745","82238909067342763610857422270101002939","268853295035193748408645351788311545918","248024506931674384526582558649556710937","211210848034560134896556834566696295420","304271199024637442779671762471264584548"],"threshold":0.9},"id":"CVE-2025-54389-fe71e381","signature_type":"Line","signature_version":"v1","source":"https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af468338078851f9","target":{"file":"src/aide.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}