CVE-2026-110102
Deferred Deferred - Pending Action

Powerlevel10k Insecure Download via Disabled TLS in gitstatus

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110102
EUVD
EUVD-2026-98935

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
romkatv powerlevel10k 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Powerlevel10k through version 1.20.0 has an insecure download flaw in the gitstatus/install script. It disables TLS certificate verification using curl -k and skips integrity checks if no SHA-256 utility is available. Attackers on the network can intercept requests to github.com and replace the archive with malicious code. This runs as the gitstatusd daemon under the user's account every time the prompt is used.

Detection Guidance

Check if Powerlevel10k is installed and inspect the gitstatus/install script for insecure curl -k usage or disabled TLS verification. Look for modified or unexpected gitstatusd daemon processes running under user accounts.

Impact Analysis

An attacker could execute arbitrary code on your system with your user privileges. This could lead to data theft, installation of malware, or further network compromise. The attack occurs silently during normal shell prompt operations, making it hard to detect.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and integrity. GDPR requires secure data handling, and HIPAA mandates protection of sensitive health data. The lack of TLS verification and integrity checks may lead to unauthorized access or tampering, potentially resulting in non-compliance and legal consequences.

Mitigation Strategies

Upgrade Powerlevel10k to a version beyond 1.20.0. Remove or replace the gitstatus/install script if it contains insecure curl -k commands. Monitor for unauthorized gitstatusd processes and review network traffic for suspicious github.com mirror requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart