LOWCVSS 3.3Vulnerability
CVE-2026-75483
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Properties
- severity
- LOW
- cvss_severity
- LOW
- cvss_score
- 3.3
- retrieved_at
- 2026-09-25T15:10:02+00:00
- score
- 3.3
- last_source
- NVD
- cve_id
- CVE-2026-75483
- cvss_vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- signal_observed_at
- 2026-09-25T15:10:02+00:00
- vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- published_at
- 2026-08-17T21:16:57.930
- last_modified
- 2026-09-24T20:06:30.133
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Escape, Meta, or Control Sequences
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph