Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-75483powerlevel10k Control Character Injection via package.json Version
Low 3.3
In plain English
A low-severity security flaw in powerlevel10k from romkatv. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 93.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| romkatv | powerlevel10k | 0 – through 1.20.0 |
Weakness: CWE-150 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- GitHub Issue #2961 issue-tracking
- https://github.com/romkatv/powerlevel10k product
- bug fix: slap (V) on the content of `package` (#2961) patch
- prompt_package in internal/p10k.zsh technical-description
- VulnCheck Advisory: powerlevel10k Control Character Injection via package.json Version third-party-advisory