CVE-2026-49147: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences in PETDANCE App::Ack
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.
AI Analysis
Technical Summary
CVE-2026-49147 describes a vulnerability in PETDANCE's App::Ack Perl module where filenames containing terminal control sequences are printed without proper sanitization in certain output modes. This improper neutralization of escape sequences (CWE-150) can lead to terminal output manipulation by embedding cursor movement or color escape codes in filenames. While version 3.10.0 added partial sanitization for some output paths, other paths remain vulnerable, allowing escape sequences to reach the terminal or downstream consumers unchanged.
Potential Impact
The vulnerability allows an attacker to craft filenames with embedded terminal control sequences that, when displayed by vulnerable versions of App::Ack, can overwrite or recolor previous terminal output or be passed unchanged to other processes. This can cause confusion, misrepresentation of terminal content, or potential interference with downstream processing that consumes these filenames. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid displaying filenames with untrusted or potentially malicious control sequences using the vulnerable output modes (--show-types, -l/-L, -c) until an official fix is released. Consider using output modes that apply the _safe_filename sanitization helper as a temporary mitigation.
CVE-2026-49147: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences in PETDANCE App::Ack
Description
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49147 describes a vulnerability in PETDANCE's App::Ack Perl module where filenames containing terminal control sequences are printed without proper sanitization in certain output modes. This improper neutralization of escape sequences (CWE-150) can lead to terminal output manipulation by embedding cursor movement or color escape codes in filenames. While version 3.10.0 added partial sanitization for some output paths, other paths remain vulnerable, allowing escape sequences to reach the terminal or downstream consumers unchanged.
Potential Impact
The vulnerability allows an attacker to craft filenames with embedded terminal control sequences that, when displayed by vulnerable versions of App::Ack, can overwrite or recolor previous terminal output or be passed unchanged to other processes. This can cause confusion, misrepresentation of terminal content, or potential interference with downstream processing that consumes these filenames. There is no indication of remote code execution or privilege escalation from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid displaying filenames with untrusted or potentially malicious control sequences using the vulnerable output modes (--show-types, -l/-L, -c) until an official fix is released. Consider using output modes that apply the _safe_filename sanitization helper as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-05-27T17:50:04.538Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4e65c2c9d9e3dbe34c9b01
Added to database: 07/08/2026, 14:59:14 UTC
Last enriched: 07/08/2026, 15:13:48 UTC
Last updated: 07/08/2026, 15:58:56 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.