PT-2026-137159
CVE-2026-122137
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
6.7
MediumMetricsAV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.
Found an issue in the description? Have something to add? Feel free to write us 👾