CVE-2026-75483 | BDVDB-2026-360739 Detail
romkatvpowerlevel10k
Description#
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: local.
Weaknesses#
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
References#
- https://github.com/romkatv/powerlevel10k/issues/2961
- https://github.com/romkatv/powerlevel10k
- https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350
- https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh
- https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.