CVE-2026-110102powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
Updated under an hour ago ()
Does this affect you?
It affects romkatv powerlevel10k. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.12%, higher than 2% of scored CVEs.
Do this next
Free account, 1 product
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-494
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.12% (percentile 2)
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 13, 2026
Affected products
romkatv powerlevel10k romkatv:powerlevel10k (from the name) | through 1.20.0 | CNA record |
References
- https://github.com/romkatv/powerlevel10k/issues/2970issue-tracking, technical-description
- https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L333technical-description
- https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348technical-description
- https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-code-without-integrity-check-in-gitstatus-installerthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.