Executive brief
App::Ack (ack) is a popular command-line tool used by developers to search through source code. A security vulnerability exists where the tool automatically loads configuration files from the current directory, which can be manipulated to force the tool to read and display sensitive files from outside the intended project folder. If a developer runs the tool within a malicious or untrusted code repository, an attacker could potentially gain access to private system files or credentials.
Technical details
App::Ack (ack) through version 3.10.0 is vulnerable to an arbitrary file read/information disclosure due to an incomplete blocklist in App::Ack::ConfigLoader. The tool automatically searches for and loads options from a .ackrc file in the directory hierarchy. Because the --files-from option is not included in the project-source option blocklist, a malicious .ackrc file in an untrusted repository can specify arbitrary file paths. When a user runs ack in that directory, the tool will read the specified files and print any matching lines to the terminal. While version 3.10.0 added --follow to the blocklist, --files-from remains exploitable.
Affected products
- PETDANCE App::Ack (ack) 0 through 3.10.0
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory