CVE-2026-122137 · Package
NO FIX YET · SEE WHAT TO DO
Powerlevel10k's bundled gitstatus install script reuses a predictable temporary directory when mktemp fails. A local attacker who pre-creates that directory can swap in their own gitstatusd binary, which then runs with the victim's privileges.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone who installs or updates Powerlevel10k's gitstatus component on a machine where another local user can write to the temp directory, such as a shared server or multi-user workstation. Single-user machines where only the owner has access are much less exposed. Teams that do not use Powerlevel10k can skip it.
Not affected if powerlevel10k-not-installed, single-user-machine
Who cares powerlevel10k, shell-config, zsh
p10k version or the theme's git tag) and see whether it is below 1.20.19.gitstatus-install.tmp directory in the system temp location on shared or multi-user machines.1.20.19 or later.Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.