CVE-2026-75483
MEDIUM
4,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW
3,3
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none
Description
AI Translation Available
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
150
Improper Neutralization of Escape, Meta, or Control Sequences
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Potential Impacts:
Execute Unauthorized Code Or Commands
Hide Activities
Unexpected State
Applicable Platforms
Technologies:
AI/ML
https://github.com/romkatv/powerlevel10k
https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh
https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896…
https://github.com/romkatv/powerlevel10k/issues/2961
https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-…