What is the CVSS score of CVE-2026-49147?

CVE-2026-49147 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-49147?

Within 24 hours: Identify all systems running ack versions prior to 3.10.0 using package manager queries (apt search ack, rpm -qa app-ack) or Perl module checks (perl -e 'use App::Ack; print $App::Ack::VERSION'). Within 7 days: Upgrade all instances to ack v3.10.0 or later (available via CPAN, package managers, and GitHub). Within 30 days: Audit system logs to identify any ack searches performed on untrusted file sources during the vulnerability window.

CVE-2026-49147

EUVD-2026-42275 HIGH

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

N/A vendor:alpine

GHSA-p4vj-7pqg-xhr6

Information Disclosure

7.5

CVSS 3.1 · Vendor: vendor:alpine

Severity by source

Vendor (vendor:alpine) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vendor:alpine) · only source for this CVE.

CVSS VectorVendor: vendor:alpine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 08, 2026 - 16:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 16:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 08, 2026 - 16:22 NVD

7.5 (HIGH)

Analysis Generated

Jun 08, 2026 - 17:33 vuln.today

DescriptionCVE.org

Alpine Linux: ack fixed in 3.10.0-r0

AnalysisAI

Improper neutralization of terminal control/escape sequences in ack (App::Ack), the Perl-based grep-like source-code search tool by Andy Lester, is fixed in v3.10.0 and affects all prior releases (App::Ack 0 through ≤3.10.0). When ack prints matching lines from attacker-controlled files, unsanitized control/meta sequences are passed through to the terminal, which per the CVSS vector (A:H) can disrupt or hang the terminal session and is separately tagged as an information-disclosure risk. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Identify all systems running ack versions prior to 3.10.0 using package manager queries (apt search ack, rpm -qa app-ack) or Perl module checks (perl -e 'use App::Ack; print $App::Ack::VERSION'). …

Threat intelligence, references, and detailed analysis are available after sign-in.