Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110102: Powerlevel10k prompt may run malicious code from fake download

CVE-2026-110102 · published 12 days ago

Summary

The Powerlevel10k theme's installer script downloads a helper program without verifying the server's security certificate and without checking the file's integrity when a checksum tool is missing. An attacker who can intercept the download could replace the file with malicious code that runs each time the prompt updates. Update Powerlevel10k to a version newer than 1.20.0 or modify the script to enforce certificate verification and checksum validation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
romkatv	powerlevel10k	<= 1.20.0

Original advisory text

powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

References

https://github.com/romkatv/powerlevel10k/issues/2970 Third Party Advisory
https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L33... Third Party Advisory
https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348 Third Party Advisory
https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-co... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1101... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-110102 Vendor Advisory
https://github.com/romkatv/powerlevel10k Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-494Download of Code Without Integrity Check

Timeline

Published13 Oct 2026

Updated15 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-110102 · NVD

CVE-2026-110102 · MITRE

CVE-2026-110102 · OSV

Track software like this

Free during beta