CVE-2026-75483: powerlevel10k Control Character Injection via package.json Version
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75483?
The severity of CVE-2026-75483 is classified as low with a score of 3.3.
How do I fix CVE-2026-75483?
To fix CVE-2026-75483, update the powerlevel10k package to a version where the control character injection vulnerability is resolved.
What impacts does CVE-2026-75483 have on users?
CVE-2026-75483 allows attackers to inject arbitrary terminal control sequences through the package.json version string, potentially disrupting user experience.
Which software does CVE-2026-75483 affect?
CVE-2026-75483 affects the powerlevel10k prompt theme used with the npm package manager.
Can I exploit CVE-2026-75483 in my terminal?
Yes, if using an affected version of powerlevel10k, an attacker could exploit CVE-2026-75483 by injecting escape sequences in the package.json version field.