CVE-2026-49147
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in App::Ack through version 3.10.0 for Perl causes unsanitized terminal escape sequences from filenames to be printed in several output modes. When ack prints a filename containing terminal control bytes like ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitizes filenames in -f, -g, colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.
Risk Assessment
A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, potentially leading to manipulation of displayed data or passing unsanitized data to a downstream consumer.
Recommendation
It is recommended to update App::Ack to the latest version that includes full sanitization of filenames in all output modes. If an update is not possible, avoid using the --show-types, -l/-L, and -c modes with files of unknown names.
Other vulnerabilities in App::Ack
See all- CVE-2026-49146High
A vulnerability in App::Ack for Perl before version 3.10.0 allows memory exhaustion via an unbounded context value in a project .ackrc. Ack searches the directory hierarchy for .ackrc and loads its options, where -B and -C accept any positive integer, potentially allocating a huge buffer.
- CVE-2026-49145High
A vulnerability in App::Ack for Perl (up to version 3.10.0) allows reading arbitrary files via the --files-from option in a project .ackrc file. Ack searches the directory hierarchy for .ackrc and loads its options, but the option blocklist does not include --files-from, enabling a malicious repository to read files outside the project.
Original NVD description (English source)
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.