CVE-2026-110102: powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this attack path?
Systems using Powerlevel10k through 1.20.0 are exposed when the gitstatus installer downloads its archive from the github.com mirror. The attacker must be in a network position to intercept that download request.
What conditions make exploitation possible?
Exploitation requires a user to run the installer and interact with a prompt after the substituted archive is installed. The installer disables TLS certificate verification with curl -k, and integrity verification is skipped when no SHA-256 utility is available.
What is the impact of a successful archive substitution?
A malicious archive can execute as the gitstatusd daemon under the affected user's account. It runs on every prompt, with the confidentiality, integrity, and availability impact of that user account.
What can be done when an immediate update is not available?
Avoid downloading gitstatus archives through the affected installer path over networks where interception is a concern. Ensure a SHA-256 utility is present so that the installer does not skip its integrity-check step.