App::Ack versions up to 3.10.0 print filenames containing terminal control characters, such as ANSI escape sequences, directly to the terminal or to downstream consumers without sanitisation in several output modes. This allows an attacker to craft a file whose name embeds cursor‑movement, colour, or screen‑clear codes; when ack processes such a file the terminal interprets the codes, enabling the attacker to overwrite or recolour earlier output or otherwise manipulate the terminal session. The flaw is a classic example of improper sanitisation of user‑controlled content (CWE‑150).

The impacted product is PETDANCE: App::Ack. All releases from the earliest version through 3.10.0 are vulnerable. The 3.10.0 release introduced a _safe_filename helper that sanitises the filenames printed by –f, –g, the coloured match heading, and per‑match lines, but it does not affect the –show‑types, –l, –L, or –c options, which continue to emit raw paths.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% signals a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue, so no public exploits are known. Based on the description, attack vector is local; any user who can execute ack against a directory containing specially named files can trigger the injection, leading to terminal tampering or corruption of scripts that process ack's output.