CVE-2026-49147: App::Ack Terminal Escape Sequence Injection in Filenames

Technical summary

The vulnerability stems from improper handling of terminal control characters in filename output. App::Ack version 3.10.0 introduced a _safe_filename sanitization function that addresses escape-sequence injection in -f (list filenames), -g (match filenames), colored match headings, and per-match output lines. However, the --show-types, -l (list files), -L (list files without matches), and -c (count matches) output modes still print raw filenames without sanitization. An attacker can craft a filename with embedded ANSI escape sequences (e.g., ESC[2J to clear screen, or ESC[H to reposition cursor) that execute when ack renders that filename in a terminal. The root cause is inconsistent application of output encoding across all code paths. CWE-150 (Improper Neutralization of Input Leading to Mangled Output) classifies this weakness.

Business impact

For organizations using ack in automated workflows, CI/CD pipelines, or shared development environments, this vulnerability can degrade tool reliability and user trust. Attackers who can influence filenames in indexed directories (via malicious downloads, repository commits, or archive extraction) gain a mechanism to corrupt log output, hide errors, or inject fake error messages that mislead incident response teams. In environments where ack output feeds into alerting systems or compliance reporting, injected escape sequences could suppress notifications or falsify audit logs. The impact is heightened in multi-tenant or untrusted-source scenarios where filename control by adversaries is plausible.

Affected systems

All users and systems running App::Ack versions up to and including 3.10.0 are affected. This includes developers on Linux, macOS, and other Unix-like systems, as well as automation scripts and containerized workloads that invoke ack as a search tool. The vulnerability does not affect Windows terminals that do not interpret ANSI escape codes by default, though modern Windows 10+ terminals can be configured to do so. Any downstream tool or script that parses ack output and feeds it to a terminal without additional sanitization is also at risk of being exploited indirectly.

Exploitability

Exploitability is straightforward and requires only that an attacker can create or influence a filename in a directory that a user or automation will search with ack. No authentication, user interaction beyond normal ack usage, or network access is required. The attack surface expands in scenarios involving downloaded files, extracted archives, shared repositories, or user-supplied input that is persisted as files. The escape sequences execute passively when ack renders the filename, making this a low-friction attack. However, real-world impact depends on whether the attacker's goal (terminal manipulation, log corruption, downstream injection) aligns with the specific output mode being used and the downstream consumer.

Remediation

Upgrade App::Ack to a patched version that applies the _safe_filename sanitization consistently across all output modes, including --show-types, -l, -L, and -c. Verify the exact patched version against the vendor's official advisory or release notes. Until patching is feasible, mitigate by running ack in non-interactive contexts (where terminal output is captured to files or logs) or by piping ack output through a sanitization tool such as cat -v or ansi. Restrict file creation in directories being searched to trusted users only, and avoid searching directories containing untrusted or user-supplied files.

Patch guidance

Check the official App::Ack repository and release history for versions newer than 3.10.0 that apply the _safe_filename function to all output code paths. Verify the specific patch version through the vendor's release notes or commits that address CWE-150. Update via your Perl package manager (CPAN, apt, yum, homebrew, etc.) once a patched version is released and tested in your environment. Regression testing should confirm that the patch does not break existing ack functionality or change output formatting for legitimate filenames.

Detection guidance

Detect potential exploitation by monitoring for filenames containing ANSI escape sequences in directories being indexed or searched. Unix command-line tools like find with -print0 and od can reveal raw bytes in filenames. Log analysis should flag ack invocations with atypical output if terminal corruption or missing log entries are observed. Network-based detection is not applicable; focus on endpoint and process-level monitoring. Review file creation patterns in shared directories or CI/CD artifact repositories for suspicious escape-sequence characters (e.g., byte sequences starting with 0x1B).

Why prioritize this

This vulnerability merits HIGH priority because it enables denial of availability and integrity attacks on terminal output and downstream tools with no authentication or user interaction required. While the attack surface is narrower than network-exposed vulnerabilities, the ease of exploitation and the potential for supply-chain contamination (e.g., malicious filenames in published archives or repositories) justify urgent patching. Organizations relying on ack for log parsing, code search, or automation should patch proactively.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack vector with low complexity and no privilege requirement, resulting in high availability impact (terminal denial, tool malfunction). The scope is unchanged (impact is confined to the ack process and its output), and there is no direct confidentiality or integrity impact on data at rest. The score appropriately captures the ease of exploitation and the real potential for operational disruption in automated environments, though it may underweight scenarios involving log falsification or supply-chain injection.

Frequently asked questions