CVE-2026-75483
- Source
- https://cve.org/CVERecord?id=CVE-2026-75483
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75483.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-75483
- Published
- 2026-08-17T20:36:08Z
- Modified
- 2026-08-22T03:31:11Z
- Severity
-
- 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- powerlevel10k Control Character Injection via package.json Version
- Details
-
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-150" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75483.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75483.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-75483
- https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version
- https://github.com/romkatv/powerlevel10k/issues/2961
- https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350
- https://github.com/romkatv/powerlevel10k
- https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh
Affected packages
Git / github.com/romkatv/powerlevel10k
Affected ranges
- Type
- GIT
- Repo
- https://github.com/romkatv/powerlevel10k
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.20.0" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }