CVE-2026-75483

Description

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.

References

https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version

https://github.com/romkatv/powerlevel10k/issues/2961

https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350

https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh

https://github.com/romkatv/powerlevel10k

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4