romkatv Powerlevel10k up to 1.20.18 Install Script gitstatus/install mktemp temp file

Summaryinfo

A vulnerability was found in romkatv Powerlevel10k up to 1.20.18. It has been rated as problematic. Affected is the function mktemp of the file gitstatus/install of the component Install Script. This manipulation causes temp file. This vulnerability is handled as CVE-2026-122137. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in romkatv Powerlevel10k up to 1.20.18 and classified as problematic. Affected by this vulnerability is the function mktemp of the file gitstatus/install of the component Install Script. The manipulation with an unknown input leads to a temp file vulnerability. The CWE definition for the vulnerability is CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-122137 since 11/04/2026. The exploitation appears to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 1.20.19 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• romkatv

Name

• Powerlevel10k

Version

• 1.20.0
• 1.20.1
• 1.20.2
• 1.20.3
• 1.20.4
• 1.20.5
• 1.20.6
• 1.20.7
• 1.20.8
• 1.20.9
• 1.20.10
• 1.20.11
• 1.20.12
• 1.20.13
• 1.20.14
• 1.20.15
• 1.20.16
• 1.20.17
• 1.20.18

Website

• Product: https://github.com/romkatv/powerlevel10k/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion