CVE-2026-75483: powerlevel10k 0 through 1.20.0

CVE-2026-75483. CVSS 3.1 base score 3.3 (LOW, Vendor/CNA). EPSS 0.00171 (percentile 0.06187), scored 22-Oct-2026.

Affected technology

powerlevel10k · 0 through 1.20.0
romkatv

Description’s affected range: version field when rendering the package prompt segment

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and availability impact as none; integrity impact as low.

Published 23-Oct-2026 16:21 UTC

CWE: CWE-150
CCR priority: 13.2 /100 (P5)
CVSS 3.1: 3.3 /10 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · Vendor/CNA
EPSS: 0.00171 · percentile 0.06187 · 2026-10-22
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-23 16:20:36.797830+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-75483.html