CVE-2026-75483
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Risk Assessment
The risk includes arbitrary terminal control sequence injection, potentially leading to visual spoofing, data exfiltration, or other malicious actions in the terminal session.
Recommendation
Update powerlevel10k to a patched version and avoid entering directories with untrusted package.json files.
Original NVD description (English source)
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.