CVE-2026-75483
powerlevel10k Control Character Injection via package.json Version
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
| CWE | CWE-150 |
| Vendor | romkatv |
| Product | powerlevel10k |
| Published | Aug 17, 2026 |
| Last Updated | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for romkatv powerlevel10k
Be the first to know when new low vulnerabilities affecting romkatv powerlevel10k are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
romkatv / powerlevel10k
0 ≤ 1.20.0
References
github.com: https://github.com/romkatv/powerlevel10k/issues/2961 github.com: https://github.com/romkatv/powerlevel10k github.com: https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350 github.com: https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh vulncheck.com: https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version
Credits
🔍 George Chen