CVE-2026-49147 Other in App::Ack
Attackers can manipulate terminal output via crafted filenames in App::Ack, potentially misleading users or affecting downstream consumers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49147?
CVE-2026-49147 is a high-severity vulnerability in PETDANCE App::Ack, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes.
When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.
A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.
Weakness: CWE-150
Which versions are affected by CVE-2026-49147?
How do I fix CVE-2026-49147?
Upgrade to a fixed version.
Is CVE-2026-49147 being exploited?
There is no known exploitation of CVE-2026-49147 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-49147, DEBIAN-CVE-2026-49147, GHSA-p4vj-7pqg-xhr6, UBUNTU-CVE-2026-49147.