# CVE-2026-49147

## Summary

- **CVE ID:** CVE-2026-49147
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-150
- **Published:** Jul 8, 2026
- **Last Modified:** Jul 8, 2026

## Description

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes.

When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.

A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.

## Affected Products

- PETDANCE — App::Ack (0)

## References

- [CNA](https://metacpan.org/release/PETDANCE/ack-v3.10.0/source/Changes)
- [CVE](http://www.openwall.com/lists/oss-security/2026/07/08/9)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.49%
- **EPSS Percentile:** 40.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._