CVE-2026-49145 Overview
CVE-2026-49145 affects App::Ack versions through 3.10.0 for Perl. The ack utility reads arbitrary files when a project .ackrc file specifies the --files-from option. The project-source option blocklist in App::Ack::ConfigLoader omits --files-from, allowing a committed .ackrc in an untrusted repository to direct ack to read and print contents of files outside the project. Version 3.10.0 added --follow to the blocklist but left --files-from accepted. This flaw maps to [CWE-73: External Control of File Name or Path].
Critical Impact
A malicious .ackrc committed to a repository can force ack to read arbitrary files on the user's system and print matching lines to output.
Affected Products
- App::Ack for Perl, all versions through 3.10.0
- Any environment where users clone untrusted repositories and run ack
- Development workstations and CI pipelines using ack for code search
Discovery Timeline
- 2026-07-08 - CVE-2026-49145 published to the National Vulnerability Database (NVD)
- 2026-07-08 - Disclosure posted to the OpenWall oss-security mailing list
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-49145
Vulnerability Analysis
The ack tool searches upward from the current working directory for a project .ackrc configuration file. When found, it loads options from that file automatically. App::Ack::ConfigLoader maintains a blocklist of options that are unsafe to accept from a project-level configuration file. The --files-from option, which instructs ack to read the list of files to search from a specified path, is missing from that blocklist.
An attacker who controls a repository can commit a .ackrc file containing --files-from=/path/to/target. When a victim clones the repository and runs ack inside it, ack reads the attacker-specified path, then reads and searches every file listed within it. Matching lines are printed to standard output. Version 3.10.0 added --follow to the blocklist but left --files-from unrestricted.
Root Cause
The root cause is an incomplete option blocklist in App::Ack::ConfigLoader. The design permits project-local configuration to override behavior without validating whether options can reference filesystem paths outside the project boundary. --files-from bypasses the intended trust boundary between project configuration and user filesystem access.
Attack Vector
Exploitation requires a victim to run ack within a directory tree that contains a hostile .ackrc. The attacker publishes a repository containing the crafted configuration. When the victim clones and searches the repository with ack, arbitrary local files can be exposed. Refer to the MetaCPAN Release Notes and the OpenWall OSS-Security Post for technical details.
Detection Methods for CVE-2026-49145
Indicators of Compromise
- Presence of .ackrc files in cloned repositories containing --files-from directives
- ack process reads to files outside the current project tree, such as /etc/passwd, ~/.ssh/, or ~/.aws/credentials
- Unexpected ack output lines referencing filesystem paths not present in the repository
Detection Strategies
- Scan repositories and developer workstations for .ackrc files containing the string --files-from before executing ack
- Audit shell history and command logs for ack invocations that produced output referencing sensitive file paths
- Monitor file access telemetry for ack reading files outside expected project directories
Monitoring Recommendations
- Enable process and file access logging on developer endpoints and CI runners that execute ack
- Alert on ack opening files under sensitive paths such as /etc/, SSH key directories, or cloud credential stores
- Track cloned repositories that introduce .ackrc files into developer environments
How to Mitigate CVE-2026-49145
Immediate Actions Required
- Inspect any .ackrc in untrusted repositories before running ack, and delete or neutralize files containing --files-from
- Restrict ack execution in CI pipelines to sandboxed workspaces without access to sensitive host files
- Educate developers to treat repository-provided .ackrc files as untrusted input
Patch Information
A fix that adds --files-from to the project-source blocklist in App::Ack::ConfigLoader was not published as of the CVE record. Version 3.10.0 addressed the related --follow option but did not remediate --files-from. Monitor the MetaCPAN Release Notes for a release that extends the blocklist.
Workarounds
- Set the environment variable ACKRC to a trusted path so project .ackrc files are ignored
- Invoke ack with --noenv to disable loading of project and user configuration files
- Remove or rename any .ackrc file found in a freshly cloned repository before running ack
# Configuration example: disable project .ackrc loading
ack --noenv 'pattern' path/
# Or force a trusted configuration file
export ACKRC="$HOME/.ackrc.trusted"
ack 'pattern' path/
# Detect malicious project configs before running ack
grep -RIn -- '--files-from' . --include='.ackrc'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
