CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to inject raw escape bytes into the version string of the package.json file used by powerlevel10k, potentially leading to the execution of arbitrary terminal control sequences during prompt rendering. While the severity is rated low, it can still be exploited to manipulate terminal behavior, which may lead to information disclosure or user confusion. Developers and system administrators using powerlevel10k should prioritize addressing this issue to mitigate potential risks in their terminal environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.