Read the docs
TI-2026-85178 Aliases CVE-2026-122137GHSA-pfwr-f3c5-mfgm

Insecure temporary directory in Powerlevel10k gitstatus installer

Priority LOW 23CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Powerlevel10k before 1.20.19 contains an insecure temporary directory flaw in its bundled gitstatus install script (CWE-377). The script reuses attacker-creatable directories when mktemp fails. A local attacker with low privileges can pre-create the predictable gitstatus-install.tmp directory and replace the extracted gitstatusd binary, which then runs with the victim's privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.

Why it matters now

EPSS 0.00115 1st percentileScored 2026-11-07
Fix Fixed powerlevel10k (romkatv): 1.20.19

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
romkatvpowerlevel10kbefore 1.20.191.20.19Patch availableCNA
romkatvgitstatusup to 1.5.5—No fix listedCNA
  • powerlevel10k Vendorromkatv Affected before 1.20.19 Fixed in 1.20.19 Patch available CNA
  • gitstatus Vendorromkatv Affected up to 1.5.5 Fixed in — No fix listed CNA

Remediation

Update Powerlevel10k to version 1.20.19. The sources list no fixed version for gitstatus.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA powerlevel10k (romkatv) Fixed in 1.20.19

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    romkatv powerlevel10k 1.20.19

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-85177 Symlink following in Powerlevel10k instant prompt temporary filePriority LOW 18
    Show all 2 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122137
  2. 2026-11-04 Alias added: GHSA-pfwr-f3c5-mfgm
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 2

Other 3

  • TI-2026-71988 Powerlevel10k gitstatus installer skips integrity checks CVSS 4.0HIGH 7.7
  • TI-2026-52867 powerlevel10k Control Character Injection via package.json Version CVSS 4.0MEDIUM 4.8
  • TI-2026-85177 Symlink following in Powerlevel10k instant prompt temporary file CVSS 4.0MEDIUM 4.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences