CVE-2026-49147

Name of the Vulnerable Software and Affected Versions App::Ack versions prior to 3.10.0

Description The software prints unsanitized terminal escape sequences from filenames in several output modes. When a filename's basename contains terminal control bytes, such as ANSI escape sequences (codes used to control cursor movement, color, and other options of text terminals), these bytes are sent to the terminal unchanged. This can allow a file with a specially crafted name to overwrite or recolor previous terminal output or pass the sequences unchanged to a downstream consumer. The issue persists in the --show-types, -l/-L, and -c paths.

Recommendations Update to version 3.10.0 or later.