Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: romkatv Clear all filters
TI-2026-85178 CVE-2026-122137 · GHSA-pfwr-f3c5-mfgm

Insecure temporary directory in Powerlevel10k gitstatus installer

Priority LOW 23

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00115 Published 2026-11-04 Fixed in 1.20.19 CWE-377
TI-2026-85177 CVE-2026-122136 · GHSA-v68w-4wfv-crrh

Symlink following in Powerlevel10k instant prompt temporary file

Priority LOW 18

Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path.

CVSS 4.0MEDIUM 4.1 Local Low privileges User interaction EPSS 0.0012 Published 2026-11-04 Fixed in 1.20.19 CWE-59
TI-2026-71988 CVE-2026-110102 · GHSA-hvg4-58mj-cjjc

Powerlevel10k gitstatus installer skips integrity checks

Priority LOW 34

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00121 Published 2026-10-13 No fix listed CWE-494