Romkatv Powerlevel10k vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Romkatv Powerlevel10k: 2 record(s), with affected versions and fixes.
CVE-2026-110102
High · 7.5
CWE-494 Oct 13, 2026
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
CVE-2026-75483
Low · 3.3
CWE-150 Aug 17, 2026
powerlevel10k Control Character Injection via package.json Version
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.