Powerlevel10k Terminal Control Sequence Injection via package.json Version

Executive Summary

powerlevel10k does not properly filter control characters in the version field of package.json when displaying the package prompt segment. Attackers can insert escape sequences in the version string to execute arbitrary terminal commands whenever the shell loads a directory containing a malicious package.json file.

Useful 0 Not Useful 0

Detection Guidance

Check if powerlevel10k is installed and inspect package.json files in directories you frequently access. Look for version fields containing escape sequences or control characters. Use grep to search for suspicious patterns like \x1b or \033 in version strings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary commands on your system whenever you enter a directory with a specially crafted package.json file. This could lead to data theft, system compromise, or further network infiltration depending on the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves terminal control sequence injection in a shell prompt rendering tool. However, if exploited to manipulate terminal output, it could potentially interfere with logging or monitoring systems that rely on accurate terminal data, indirectly impacting compliance reporting.

Useful 0 Not Useful 0

Mitigation Strategies

Update powerlevel10k to the latest version that patches this issue. Avoid using untrusted package.json files in directories where powerlevel10k renders prompts. Temporarily disable the package prompt segment in powerlevel10k configuration if an update is unavailable.

Useful 0 Not Useful 0