The vulnerability in App::Ack versions up to 3.10.0 involves printing unsanitised terminal escape sequences embedded in filenames. When ack outputs filenames whose basenames contain terminal control bytes (e.g., ANSI escape sequences), these bytes are passed to the terminal without sanitization in certain output modes (--show-types, -l/-L, and -c). This can lead to manipulation of terminal display or unintended effects on downstream processes consuming the output. Version 3.10.0 added a _safe_filename helper to sanitize filenames in some output modes (-f, -g, colored match heading, and per-match lines), but not all paths are sanitized.

The impact is primarily on terminal output integrity and availability. Unsanitised terminal escape sequences in filenames can overwrite or recolor previous terminal output, potentially causing confusion or hiding information. Additionally, these sequences can be passed unchanged to downstream consumers, which might lead to unexpected behavior or disruption. The CVSS vector indicates no confidentiality or integrity impact, but a high impact on availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No known exploits in the wild have been reported.

No explicit patch or official fix information is provided in the input data. Version 3.10.0 partially mitigates the issue by sanitizing filenames in some output modes, but others remain vulnerable. Users should upgrade to versions later than 3.10.0 when available to benefit from improved sanitization. Until then, avoid using vulnerable output modes with untrusted filenames containing terminal control sequences. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.