Powerlevel10k CVE-2026-110102

Exploitation requires the attacker to hold a privileged network position (man-in-the-middle) on the path to github.com, and the victim to trigger the gitstatus installer by installing or updating Powerlevel10k (versions through 1.20.0). Two code conditions enable substitution: the installer fetches the gitstatusd binary with curl -k, disabling TLS certificate validation, and it skips the SHA-256 integrity verification when no hashing utility (sha256sum/shasum/openssl) is available on the host. Limiting factors that reduce real-world risk: no exploitation is possible without an active download/update event, the attacker must already control or intercept the network path (not remotely reachable against an idle host), and hosts that do have a SHA-256 utility still get the integrity check even though the TLS downgrade remains. Once the malicious binary is installed it runs as gitstatusd under the victim's account on every prompt, giving persistence at that user's privilege level.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 base score of 7.7 (High) reflects full compromise of the vulnerable system (VC:H/VI:H/VA:H) with no authentication (PR:N), but it is tempered by two key modifiers the vendor vector makes explicit: AT:P (a specific attack requirement - the attacker must hold a privileged network/man-in-the-middle position on the path to github.com) and UI:P (passive user interaction - the victim must install or update Powerlevel10k/gitstatus for the vulnerable download to fire). In effect the severity is high but the preconditions are meaningful: this is not spray-and-pray internet-exploitable. Exploitation status is 'no public exploit identified at time of analysis' - no CISA KEV listing and no POC are present in the provided data, and no EPSS score was supplied, so the quantitative exploitation-probability signal is MISSING and cannot be compared against the severity. SSVC-style reasoning: exploitation is likely low/none, automatable is partial-to-no (requires MITM positioning per-target, not a simple internet-wide scan), technical impact is total. One data conflict to flag explicitly: the only tag provided is 'Information Disclosure', which contradicts CWE-494 (Download of Code Without Integrity Check) and the High integrity/availability impacts - this vulnerability yields code execution, not mere disclosure, so defenders should treat it as an RCE-class issue and not deprioritize it as read-only data leakage.

A victim on a shared or hostile network (public Wi-Fi, a compromised corporate proxy/router, or a malicious upstream) installs or updates Powerlevel10k, triggering the gitstatus installer to fetch the gitstatusd binary from the github.com mirror. Because the script uses curl -k (disabling TLS certificate verification) and skips the SHA-256 integrity check when no hashing utility is present, the network-positioned attacker substitutes a malicious archive. The planted binary then executes as the gitstatusd daemon under the victim's account on every subsequent shell prompt; no public POC is noted in the available data.