Romkatv vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Romkatv products: 2 record(s), with severity, exploitation and fixes.

Powerlevel10k 2

Exploited only (KEV) →

CVE-2026-110102 High · 7.5 CWE-494 Oct 13, 2026

powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

CVE-2026-75483 Low · 3.3 CWE-150 Aug 17, 2026

powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.