romkatv vulnerabilities

Products

• powerlevel10k 4
• gitstatus 1

Latest romkatv CVEs

Newest publication first

1. CVE-2026-122137 Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer

   Published 2026-11-04

   Medium·CVSS 5.4 EPSS 0.11%

   Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the...

2. CVE-2026-122136 Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File

   Published 2026-11-04

   Medium·CVSS 4.1 EPSS 0.12%

   Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPD...

3. CVE-2026-110102 powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

   Published 2026-10-13

   High·CVSS 7.7 EPSS 0.12%

   Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mi...

4. CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

   Published 2026-08-17

   Medium·CVSS 4.8 EPSS 0.17%

   powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.