Search
Find a vulnerability
Search criteria
2 vulnerabilities found for powerlevel10k by romkatv
CVE-2026-75483 (GCVE-0-2026-75483)
Vulnerability from nvd – Published: 2026-08-17 20:36 – Updated: 2026-08-20 15:24
VLAI
EPSS
VEX
Title
powerlevel10k Control Character Injection via package.json Version
Summary
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:41 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/romkatv/powerlevel10k/issues/2961 | issue-tracking |
| https://github.com/romkatv/powerlevel10k | product |
| https://github.com/romkatv/powerlevel10k/commit/5… | patch |
| https://github.com/romkatv/powerlevel10k/blob/mas… | technical-description |
| https://www.vulncheck.com/advisories/powerlevel10… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| romkatv | powerlevel10k |
Affected:
0 , ≤ 1.20.0
(custom)
|
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:41:48.476060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:24:24.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "powerlevel10k",
"repo": "https://github.com/romkatv/powerlevel10k",
"vendor": "romkatv",
"versions": [
{
"lessThanOrEqual": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T00:44:22.288Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2961",
"tags": [
"issue-tracking"
],
"url": "https://github.com/romkatv/powerlevel10k/issues/2961"
},
{
"tags": [
"product"
],
"url": "https://github.com/romkatv/powerlevel10k"
},
{
"name": "bug fix: slap (V) on the content of `package` (#2961)",
"tags": [
"patch"
],
"url": "https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350"
},
{
"name": "prompt_package in internal/p10k.zsh",
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh"
},
{
"name": "VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Version",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version"
}
],
"title": "powerlevel10k Control Character Injection via package.json Version",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75483",
"datePublished": "2026-08-17T20:36:08.150Z",
"dateReserved": "2026-08-17T19:59:23.461Z",
"dateUpdated": "2026-08-20T15:24:24.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75483 (GCVE-0-2026-75483)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:36 – Updated: 2026-08-20 15:24
VLAI
EPSS
VEX
Title
powerlevel10k Control Character Injection via package.json Version
Summary
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:41 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/romkatv/powerlevel10k/issues/2961 | issue-tracking |
| https://github.com/romkatv/powerlevel10k | product |
| https://github.com/romkatv/powerlevel10k/commit/5… | patch |
| https://github.com/romkatv/powerlevel10k/blob/mas… | technical-description |
| https://www.vulncheck.com/advisories/powerlevel10… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| romkatv | powerlevel10k |
Affected:
0 , ≤ 1.20.0
(custom)
|
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:41:48.476060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:24:24.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "powerlevel10k",
"repo": "https://github.com/romkatv/powerlevel10k",
"vendor": "romkatv",
"versions": [
{
"lessThanOrEqual": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T00:44:22.288Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2961",
"tags": [
"issue-tracking"
],
"url": "https://github.com/romkatv/powerlevel10k/issues/2961"
},
{
"tags": [
"product"
],
"url": "https://github.com/romkatv/powerlevel10k"
},
{
"name": "bug fix: slap (V) on the content of `package` (#2961)",
"tags": [
"patch"
],
"url": "https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350"
},
{
"name": "prompt_package in internal/p10k.zsh",
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh"
},
{
"name": "VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Version",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version"
}
],
"title": "powerlevel10k Control Character Injection via package.json Version",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75483",
"datePublished": "2026-08-17T20:36:08.150Z",
"dateReserved": "2026-08-17T19:59:23.461Z",
"dateUpdated": "2026-08-20T15:24:24.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}