CVE-2026-122136: Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File
Powerlevel10k before 1.20.19 contains a symlink following vulnerability in p9kdumpinstantprompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Local users are exposed when Powerlevel10k runs a vulnerable _p9k_dump_instant_prompt during shell startup and uses a TMPDIR location an attacker can populate. The attacker must be able to target files writable by the victim.
What must an attacker do to exploit it?
The attacker must pre-create a symlink named p10k-instant-prompt-output-<user>-<pid> in TMPDIR and correctly guess the victim shell's PID. Exploitation also requires the victim to start a shell, causing the instant-prompt output path to be truncated and overwritten.
Are systems using a custom temporary directory affected?
The vulnerable temporary path is created in TMPDIR, so exposure depends on whether an attacker can place a symlink in the TMPDIR used by the victim's shell. The provided information does not establish whether a particular TMPDIR configuration prevents exploitation.
How can I check for signs of attempted exploitation?
Inspect the relevant TMPDIR for symlinks whose names match p10k-instant-prompt-output-<user>-<pid>, particularly for victim usernames and plausible shell PIDs. Such a symlink may indicate an attempt to redirect instant-prompt output to another file.