CVE-2026-49147: App::Ack Information Disclosure Flaw

CVE-2026-49147 Overview

CVE-2026-49147 affects App::Ack versions through 3.10.0, a Perl-based grep-like source code search tool. The vulnerability allows unsanitised terminal escape sequences from filenames to reach the terminal unchanged. Version 3.10.0 introduced a _safe_filename helper that sanitises filenames printed by -f, -g, the colored match heading, and per-match lines. However, the --show-types, -l/-L, and -c output paths still emit raw filenames containing terminal control bytes. Attackers can craft filenames embedding cursor-movement or color ANSI escape sequences to overwrite or recolor earlier terminal output. This weakness is classified under CWE-150 — Improper Neutralization of Escape, Meta, or Control Sequences.

Critical Impact
Attackers can inject terminal escape sequences through malicious filenames, manipulating terminal output visible to developers and downstream consumers of ack results.

Affected Products

App::Ack for Perl versions through 3.10.0
Command-line output modes: --show-types, -l, -L, -c
Downstream tooling consuming raw ack output

Discovery Timeline

2026-07-08 - CVE CVE-2026-49147 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49147

Vulnerability Analysis

App::Ack fails to neutralize terminal control bytes contained within filenames before printing them to standard output. When ack scans a directory tree and prints a filename whose basename contains ANSI escape sequences, those bytes are passed to the terminal emulator verbatim. Modern terminals interpret these sequences as commands, allowing an attacker to move the cursor, clear regions of the screen, or change text colors.

Version 3.10.0 partially addressed this issue by adding a _safe_filename helper. The helper sanitises filenames displayed by the file-listing (-f), file-name-only search (-g), colored match heading, and per-match line output modes. The fix is incomplete because three additional code paths still emit raw filenames.

Root Cause

The root cause is inconsistent application of output sanitisation across ack's print routines. The --show-types, -l/-L (list matching or non-matching files), and -c (count matches) code paths bypass the _safe_filename helper and write filename bytes directly to output. This inconsistency reflects the difficulty of retrofitting output escaping into a mature codebase with multiple print sites.

Attack Vector

An attacker who can create or influence filenames in a directory later scanned by ack can embed escape sequences into a basename. When a developer runs ack -l pattern, ack -c pattern, or ack --show-types pattern against the tainted directory, the terminal renders the injected sequences. The attacker can overwrite earlier lines to hide malicious content, recolor output to disguise findings, or corrupt data passed to a downstream consumer that assumes ack output is safe text.

The vulnerability manifests when ack processes filenames from repositories, archives, or shared directories controlled by untrusted parties. See the MetaCPAN Version Changes and the Openwall OSS-Security Discussion for technical details.

Detection Methods for CVE-2026-49147

Indicators of Compromise

Files or directories with basenames containing raw 0x1B (ESC) bytes or ANSI CSI sequences such as \e[ patterns
Unexpected cursor movement, screen clearing, or color changes during routine ack searches
Repository commits or archives introducing filenames with non-printable control characters

Detection Strategies

Scan source repositories and shared directories for filenames containing control bytes in the range 0x00–0x1F or 0x7F
Audit shell histories and CI logs for ack invocations using -l, -L, -c, or --show-types against untrusted input trees
Pipe ack output through cat -v or less -R when reviewing results from unfamiliar sources to reveal escape bytes

Monitoring Recommendations

Alert on filesystem create events where filenames contain escape or control characters
Log CI/CD build steps that invoke ack and capture raw byte output for inspection
Monitor package registries and version control systems for commits introducing suspicious filenames

How to Mitigate CVE-2026-49147

Immediate Actions Required

Inventory systems where App::Ack is installed and identify versions through 3.10.0
Avoid running ack -l, ack -L, ack -c, and ack --show-types against directories populated from untrusted sources until patched
Pipe ack output through a sanitising filter such as sed 's/\\x1b\[[0-9;]*[a-zA-Z]//g' when reviewing untrusted trees

Patch Information

At the time of publication, no fixed release beyond 3.10.0 is referenced in the enriched CVE data. Consult the MetaCPAN Version Changes for updates that extend the _safe_filename helper to the --show-types, -l/-L, and -c paths, and monitor the Openwall OSS-Security Discussion for downstream distribution advisories.

Workarounds

Wrap ack invocations in a shell function that filters escape sequences from output before display
Use find combined with printf %q to enumerate suspicious filenames before running ack across shared directories
Configure terminal emulators to disable or restrict interpretation of control sequences from untrusted output where feasible

bash

# Filter ANSI escape sequences from ack output
ack -l pattern ./untrusted_tree | sed -E 's/\\x1b\[[0-9;]*[a-zA-Z]//g'

# Enumerate filenames containing control bytes prior to scanning
find ./untrusted_tree -name '*'$'\\x1b''*' -print