/ 
ack-1.82
/ t/ack-line.t
Security Advisories (3)
CVE-2026-49145 (2026-07-08)

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

CVE-2026-49146 (2026-07-08)

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.

CVE-2026-49147 (2026-07-08)

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.

Dummy document

There's important stuff in here! EOF

my @files = qw( t/swamp/perl.pod );
my @args = qw( --lines=2 --passthru );

ack_lists_match( [ @args, @files ], \@expected, 'Checking --passthru behaviour with --line' );
}

LINE_1_MULTIPLE_FILES: { my @target_file = ( File::Next::reslash( 't/swamp/c-header.h' ), File::Next::reslash( 't/swamp/c-source.c' ) ); my @expected = split( /\n/, <<"EOF" ); $target_file[0]:1:/* perl.h $target_file[1]:1:/* A Bison parser, made from plural.y EOF

my @files = qw( t/swamp/ );
my @args = qw( --cc --lines=1 );

ack_sets_match( [ @args, @files ], \@expected, 'Looking for first line in multiple files' );
}

LINE_1_CONTEXT: { my @target_file = ( File::Next::reslash( 't/swamp/c-header.h' ), File::Next::reslash( 't/swamp/c-source.c' ) ); my @expected = split( /\n/, <<"EOF" ); $target_file[0]:1:/* perl.h $target_file[0]-2- * $target_file[0]-3- * Copyright (C) 1993, 1994, 1995, 1996, 1997, 1998, 1999, $target_file[0]-4- * 2000, 2001, 2002, 2003, 2004, 2005, 2006, by Larry Wall and others -- $target_file[1]:1:/* A Bison parser, made from plural.y $target_file[1]-2- by GNU Bison version 1.28 */ $target_file[1]-3- $target_file[1]-4-#define YYBISON 1 /* Identify Bison output. */ EOF

my @files = qw( t/swamp/ );
my @args = qw( --cc --lines=1 --after=3 --sort );

ack_lists_match( [ @args, @files ], \@expected, 'Looking for first line in multiple files' );
}