Description
ack 2.00 through 2.11_02 allows remote attackers to execute arbitrary code via a (1) --pager, (2) --regex, or (3) --output option in a .ackrc file in a directory to be searched.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ack | 2.15_02-1.3 | openSUSE-SU-2024:10014-1 |
Advisories 1
- openSUSE-SU-2024:10014-1 ack-2.15_02-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 55982 third-party-advisory
- openSUSE-SU-2014:0142 vendor-advisory
- 64196 vdb-entry
- https://github.com/petdance/ack2/issues/399
- [oss-security] 20131211 Re: CVE Request: ack-grep: potential remote code execution via per-project .ackrc files mailing-list