Control Character Injection in Powerlevel10k by Romkatv

CVE-2026-75483

What is CVE-2026-75483?

The Powerlevel10k prompt renderer does not properly neutralize control characters in the version field of package.json. This oversight allows attackers to inject unfiltered escape bytes into the version string. When the shell processes affected directories, it can execute arbitrary terminal control sequences, potentially leading to unauthorized access or disruption of the terminal environment. Users are urged to update to the latest version to mitigate this risk.

References