CVE-2026-75483
powerlevel10k Control Character Injection via package.json Version
- State
- Published
- Severity
- 4.8 Medium
- Published
- Aug 17, 2026
- Updated
- Aug 20, 2026
- Reserved
- Aug 17, 2026
Description
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
Affected Products
| Product | Versions |
|---|---|
powerlevel10kromkatv |
|
References
- GitHub Issue #2961issue-tracking
- https://github.com/romkatv/powerlevel10kproduct
- bug fix: slap (V) on the content of `package` (#2961)patch
- prompt_package in internal/p10k.zshtechnical-description
- VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Versionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.