CVE-2026-49145
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in App::Ack for Perl (up to version 3.10.0) allows reading arbitrary files via the --files-from option in a project .ackrc file. Ack searches the directory hierarchy for .ackrc and loads its options, but the option blocklist does not include --files-from, enabling a malicious repository to read files outside the project.
Risk Assessment
The risk is that a user running ack in an untrusted repository may unknowingly allow reading sensitive system files, whose contents will be displayed in search results.
Recommendation
It is recommended to upgrade App::Ack to version 3.10.1 or later, which adds --files-from to the blocked options list. If an upgrade is not possible, avoid running ack in untrusted repositories.
Other vulnerabilities in App::Ack
See all- CVE-2026-49147High
A vulnerability in App::Ack through version 3.10.0 for Perl causes unsanitized terminal escape sequences from filenames to be printed in several output modes. When ack prints a filename containing terminal control bytes like ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitizes filenames in -f, -g, colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.
- CVE-2026-49146High
A vulnerability in App::Ack for Perl before version 3.10.0 allows memory exhaustion via an unbounded context value in a project .ackrc. Ack searches the directory hierarchy for .ackrc and loads its options, where -B and -C accept any positive integer, potentially allocating a huge buffer.
Original NVD description (English source)
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.