CVE-2026-49147
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
08/07/2026
Last modified:
08/07/2026
Description
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes.<br />
<br />
When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.<br />
<br />
A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH