CVE-2026-75483 in powerlevel10k
Summary
by MITRE • 08/17/2026
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The powerlevel10k zsh theme contains a critical input validation flaw within its package.json parsing logic, specifically affecting the rendering of the node_version or similar prompts that display project metadata. When the shell initializes in a directory containing a package.json file, the theme attempts to extract and display version information from this configuration file. The vulnerability arises because the software fails to sanitize control characters present in the version string field before passing it to the terminal output routines. This lack of input sanitization allows an attacker who can write or modify files within a target user's workspace directory to inject raw escape sequences directly into the package.json version field.
From a technical perspective, this flaw constitutes an improper neutralization of special elements used in an output or display context, commonly categorized under CWE-117: Improper Output Neutralization for Logs and CWE-20: Improper Input Validation. The terminal emulator interprets these injected bytes as control commands rather than literal text characters. For instance, if the version string is set to a value containing ANSI escape codes such as \x1b[31m or more complex sequences like those used in shellshock-style exploitation vectors, the terminal will execute them immediately upon prompt rendering. This mechanism bypasses standard security boundaries because the input originates from a local file that appears benign but contains hidden malicious payloads encoded within its metadata fields.
The operational impact of this vulnerability is significant for developers and system administrators who frequently navigate between project directories using zsh with powerlevel10k enabled. Since the prompt renders every time the shell changes directory or refreshes, an attacker can achieve arbitrary command execution on the victim's machine simply by placing a malicious package.json in a shared network drive, a git repository that the user clones, or any other location where the user is likely to cd into. This effectively turns a standard development tool into a vector for remote code execution if combined with social engineering tactics to lure users into opening specific directories. The attack does not require elevated privileges on the target system initially, as it exploits the trust relationship between the shell and its configuration files.
This vulnerability aligns closely with ATT&CK technique T1059: Command and Scripting Interpreter, specifically sub-techniques involving terminal control sequences or environment variable injection depending on how the escape codes are structured to trigger subsequent commands. It also relates to supply chain risks where compromised dependencies or maliciously crafted repository structures can lead to client-side compromise during routine development workflows. The persistence of this risk is high because many developers rely heavily on visual feedback from their shell prompts and may not inspect the raw content of configuration files like package.json before navigating into them, assuming they are safe based on their source reputation alone.
Mitigation strategies must focus on immediate input sanitization within the theme's codebase rather than relying solely on user awareness. Developers should implement strict filtering mechanisms that strip or escape all non-printable ASCII characters and control sequences from any data read from package.json before it is passed to the print function. Additionally, users can temporarily disable the specific prompt segment responsible for reading node version information until a patched version of powerlevel10k is released. Enabling shell options such as setopt no_bash_compatible or using alternative themes that do not parse local configuration files dynamically can also reduce exposure. Long-term remediation requires integrating static analysis tools into development workflows to detect improper output handling in shell scripts and ensuring that all external data sources are treated as untrusted until explicitly validated against a whitelist of allowed characters.