Insecure Download Vulnerability in Powerlevel10k Product by romkatv

CVE-2026-110102

What is CVE-2026-110102?

The Powerlevel10k product, specifically versions up to 1.20.0, contains a significant insecurity in its gitstatus/install script that allows for the download of code without performing essential integrity checks. This vulnerability is primarily caused by the use of the curl command with the '-k' option, which disables TLS certificate verification. Furthermore, in scenarios where the SHA-256 utility is not available, integrity checks are skipped entirely. This creates a critical risk, as network-based attackers can exploit this vulnerability to intercept requests to the GitHub mirror. They could provide a malicious archive, which, once executed, runs as the gitstatusd daemon under the user's account on every prompt, potentially injecting harmful code into the user’s environment.

References