Search
Find a vulnerability
Search criteria
4 vulnerabilities found for powerlevel10k by romkatv
CVE-2026-110102 (GCVE-0-2026-110102)
Vulnerability from nvd – Published: 2026-10-13 16:53 – Updated: 2026-10-14 15:43
VLAI
EPSS
VEX
Title
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
Summary
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 15:43 UTC
CWE
- CWE-494 - Download of Code Without Integrity Check
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/romkatv/powerlevel10k/issues/2970 | issue-trackingtechnical-description |
| https://github.com/romkatv/powerlevel10k/blob/v1.… | technical-description |
| https://github.com/romkatv/powerlevel10k/blob/v1.… | technical-description |
| https://www.vulncheck.com/advisories/powerlevel10… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| romkatv | powerlevel10k |
Affected:
0 , ≤ 1.20.0
(custom)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:43:12.764512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:43:53.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "powerlevel10k",
"repo": "https://github.com/romkatv/powerlevel10k",
"vendor": "romkatv",
"versions": [
{
"lessThanOrEqual": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user\u0027s account on every prompt."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "Download of Code Without Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:53:05.596Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/issues/2970"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L333"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348"
},
{
"name": "VulnCheck Advisory: powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-code-without-integrity-check-in-gitstatus-installer"
}
],
"title": "powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110102",
"datePublished": "2026-10-13T16:53:05.596Z",
"dateReserved": "2026-10-13T16:22:16.854Z",
"dateUpdated": "2026-10-14T15:43:53.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75483 (GCVE-0-2026-75483)
Vulnerability from nvd – Published: 2026-08-17 20:36 – Updated: 2026-08-20 15:24
VLAI
EPSS
VEX
Title
powerlevel10k Control Character Injection via package.json Version
Summary
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:41 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/romkatv/powerlevel10k/issues/2961 | issue-tracking |
| https://github.com/romkatv/powerlevel10k | product |
| https://github.com/romkatv/powerlevel10k/commit/5… | patch |
| https://github.com/romkatv/powerlevel10k/blob/mas… | technical-description |
| https://www.vulncheck.com/advisories/powerlevel10… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| romkatv | powerlevel10k |
Affected:
0 , ≤ 1.20.0
(custom)
|
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:41:48.476060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:24:24.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "powerlevel10k",
"repo": "https://github.com/romkatv/powerlevel10k",
"vendor": "romkatv",
"versions": [
{
"lessThanOrEqual": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T00:44:22.288Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2961",
"tags": [
"issue-tracking"
],
"url": "https://github.com/romkatv/powerlevel10k/issues/2961"
},
{
"tags": [
"product"
],
"url": "https://github.com/romkatv/powerlevel10k"
},
{
"name": "bug fix: slap (V) on the content of `package` (#2961)",
"tags": [
"patch"
],
"url": "https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350"
},
{
"name": "prompt_package in internal/p10k.zsh",
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh"
},
{
"name": "VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Version",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version"
}
],
"title": "powerlevel10k Control Character Injection via package.json Version",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75483",
"datePublished": "2026-08-17T20:36:08.150Z",
"dateReserved": "2026-08-17T19:59:23.461Z",
"dateUpdated": "2026-08-20T15:24:24.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110102 (GCVE-0-2026-110102)
Vulnerability from cvelistv5 – Published: 2026-10-13 16:53 – Updated: 2026-10-14 15:43
VLAI
EPSS
VEX
Title
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
Summary
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 15:43 UTC
CWE
- CWE-494 - Download of Code Without Integrity Check
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/romkatv/powerlevel10k/issues/2970 | issue-trackingtechnical-description |
| https://github.com/romkatv/powerlevel10k/blob/v1.… | technical-description |
| https://github.com/romkatv/powerlevel10k/blob/v1.… | technical-description |
| https://www.vulncheck.com/advisories/powerlevel10… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| romkatv | powerlevel10k |
Affected:
0 , ≤ 1.20.0
(custom)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:43:12.764512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:43:53.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "powerlevel10k",
"repo": "https://github.com/romkatv/powerlevel10k",
"vendor": "romkatv",
"versions": [
{
"lessThanOrEqual": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user\u0027s account on every prompt."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "Download of Code Without Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:53:05.596Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/issues/2970"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L333"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348"
},
{
"name": "VulnCheck Advisory: powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-code-without-integrity-check-in-gitstatus-installer"
}
],
"title": "powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110102",
"datePublished": "2026-10-13T16:53:05.596Z",
"dateReserved": "2026-10-13T16:22:16.854Z",
"dateUpdated": "2026-10-14T15:43:53.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75483 (GCVE-0-2026-75483)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:36 – Updated: 2026-08-20 15:24
VLAI
EPSS
VEX
Title
powerlevel10k Control Character Injection via package.json Version
Summary
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:41 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/romkatv/powerlevel10k/issues/2961 | issue-tracking |
| https://github.com/romkatv/powerlevel10k | product |
| https://github.com/romkatv/powerlevel10k/commit/5… | patch |
| https://github.com/romkatv/powerlevel10k/blob/mas… | technical-description |
| https://www.vulncheck.com/advisories/powerlevel10… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| romkatv | powerlevel10k |
Affected:
0 , ≤ 1.20.0
(custom)
|
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:41:48.476060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:24:24.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "powerlevel10k",
"repo": "https://github.com/romkatv/powerlevel10k",
"vendor": "romkatv",
"versions": [
{
"lessThanOrEqual": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T00:44:22.288Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2961",
"tags": [
"issue-tracking"
],
"url": "https://github.com/romkatv/powerlevel10k/issues/2961"
},
{
"tags": [
"product"
],
"url": "https://github.com/romkatv/powerlevel10k"
},
{
"name": "bug fix: slap (V) on the content of `package` (#2961)",
"tags": [
"patch"
],
"url": "https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350"
},
{
"name": "prompt_package in internal/p10k.zsh",
"tags": [
"technical-description"
],
"url": "https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh"
},
{
"name": "VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Version",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version"
}
],
"title": "powerlevel10k Control Character Injection via package.json Version",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-75483",
"datePublished": "2026-08-17T20:36:08.150Z",
"dateReserved": "2026-08-17T19:59:23.461Z",
"dateUpdated": "2026-08-20T15:24:24.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}