Vulnerability Description
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/romkatv/powerlevel10k
- https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh
- https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a6708968
- https://github.com/romkatv/powerlevel10k/issues/2961
- https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-v
FAQ
What is CVE-2026-75483?
CVE-2026-75483 is a vulnerability with a CVSS score of 3.3 (LOW). powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit ar...
How severe is CVE-2026-75483?
CVE-2026-75483 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75483?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.