CVE-2026-122136
Deferred Deferred - Pending Action

Symlink Following in Powerlevel10k Shell Startup

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122136
EUVD
EUVD-2026-117090

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
romkatv powerlevel10k 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a symlink following issue in Powerlevel10k versions before 1.20.19. It occurs in the _p9k_dump_instant_prompt function where a predictable temporary file path is used. Attackers can create symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID. During shell startup, the instant prompt feature truncates and overwrites targeted files the victim can write to.

Detection Guidance
  • Check Powerlevel10k version with: p10k version. If version is below 1.20.19, the system is vulnerable.
  • Monitor for unexpected file truncations or overwrites in user-writable directories during shell startup.
  • Inspect TMPDIR environment variable for suspicious symlinks targeting p10k-instant-prompt-output-<user>-<pid>.
Impact Analysis

If exploited, this vulnerability allows local attackers to overwrite victim-writable files on the system. This could lead to data loss, corruption of critical files, or unauthorized modifications to system configurations. The attack requires local multi-user access and PID prediction, making shared systems like CI runners or containers more vulnerable.

Mitigation Strategies
  • Upgrade Powerlevel10k to version 1.20.19 or later immediately.
  • Avoid using shared TMPDIR directories on multi-user systems.
  • Restrict write permissions on critical files until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...