Powerlevel10K
Monthly
Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.
Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.