CVE-2026-110102

HIGH 7.5

powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

CWE	CWE-494
Vendor	romkatv
Product	powerlevel10k
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for romkatv powerlevel10k

Be the first to know when new high vulnerabilities affecting romkatv powerlevel10k are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

romkatv / powerlevel10k

0 ≤ 1.20.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/romkatv/powerlevel10k/issues/2970 github.com: https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L333 github.com: https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348 vulncheck.com: https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-code-without-integrity-check-in-gitstatus-installer

Credits

George Chen