Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L3…
disclosure@vulncheck.com
https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348
disclosure@vulncheck.com
https://github.com/romkatv/powerlevel10k/issues/2970
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-c…
disclosure@vulncheck.com