clean up CVE variant vulnerabilities

Open
  • Is something wrong?
#408 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
15/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Active
Tech stack
perl
Domain
cli, security

Research direction

Start with the regression report in issue #405 about Unicode filenames, and with PR #400, which skips a CVE test on Windows and is merged on DEV but not yet released. Run make test to reproduce the Windows setup failure. The remaining CVE work (CVE-2026-49145 and CVE-2026-49147) has no specified change, so a maintainer must first define the exploitation paths to address.

Written by the indexing model from the issue text.

Description

Ack release 3.10.0 addressed vulnerabilities in three CPANsec CVEs consolidated from five responsible-disclosures from researchers (Thank you!), and completely addressed one of the three (CVE-2026-49146). The other two (CVE-2026-49145, CVE-2026-49147) have additional esoteric exploitation paths not addressed in 3.10.0.

Also needed to clean up 3.10.0 —

  • 3.10.0 also had collateral damage wrto Unicode filenames reported in issue #405
  • one CVE test case won't reproduce on Windows so make test with that test-case fails while setting up; fixed in PR #400 (skip do-not-care test on WIN), already merged on DEV but not in release yet.
Dominant language
Perl
Stars
833
Forks
77
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from beyondgrep/ack3

All issues in beyondgrep/ack3

Similar issues

More Perl issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.