CVE-2026-75483
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Aug 17, 2026
CISA due date
—
The record
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-54162 Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. CWE-150
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150
- CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in… CWE-150
- CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-150
- CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. CWE-150
- CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. CWE-150
- CVE-2026-72913 Kitty is a cross-platform GPU based terminal. CWE-150
- CVE-2026-73035 npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape… CWE-150