CVE-2026-122137: Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer
Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Powerlevel10kto a version that resolves this vulnerability.Fixed in 1.20.19
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running Powerlevel10k versions before 1.20.19 are exposed when the bundled gitstatus/install script runs on a system where a local attacker can create the predictable temporary directory. Successful exploitation causes the substituted gitstatusd binary to run with the victim user's privileges.
What conditions does an attacker need to exploit this issue?
The attacker needs local access and must be able to pre-create the predictable gitstatus-install.tmp directory. Exploitation also depends on mktemp failing and on a victim subsequently running the affected installer; it requires user interaction and is rated high complexity.
How can I determine whether I am affected?
Check whether the installed Powerlevel10k version is earlier than 1.20.19 and whether the bundled gitstatus/install script is used. The vulnerable behavior is reuse of an existing gitstatus-install.tmp directory after mktemp fails.