/ 
ack-2.04
⭐ Starred 726 / App::Ack
Security Advisories (3)
CVE-2026-49145 (2026-07-08)

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

CVE-2026-49146 (2026-07-08)

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.

CVE-2026-49147 (2026-07-08)

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.

NAME

App::Ack - A container for functions for the ack program

VERSION

Version 2.04

SYNOPSIS

If you want to know about the ack program, see the ack file itself.

No user-serviceable parts inside. ack is all that should use this.

FUNCTIONS

remove_dir_sep( $path )

This functions removes a trailing path separator, if there is one, from its argument

warn( @_ )

Put out an ack-specific warning.

die( @_ )

Die in an ack-specific way.

filetypes_supported()

Returns a list of all the types that we can detect.

show_help()

Dumps the help page to the user.

show_help_types()

Display the filetypes help subpage.

get_version_statement

Returns the version information for ack.

Prints the version information for ack.

Return the copyright for ack.

output_to_pipe()

Returns true if ack's input is coming from a pipe.

exit_from_ack

Exit from the application with the correct exit code.

Returns with 0 if a match was found, otherwise with 1. The number of matches is handed in as the only argument.

COPYRIGHT & LICENSE

Copyright 2005-2013 Andy Lester.

This program is free software; you can redistribute it and/or modify it under the terms of the Artistic License v2.0.