Powerlevel10k through 1.20.0 hit by high-severity CVE-2026-110102

Powerlevel10k, the popular Zsh prompt theme with more than 55,000 stars on GitHub, has a high-severity insecure download flaw in the installer for its gitstatus helper, tracked as CVE-2026-110102. It affects all releases through 1.20.0.

VulnCheck rates it 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0. VulnCheck is the CVE numbering authority that published the record on October 13. NVD has not added its own score. VulnCheck's CVSS 3.1 vector describes a network attack with high complexity that needs user interaction, with high impact to confidentiality, integrity and availability.

The installer turns off TLS checks. When gitstatus needs to download its native gitstatusd daemon, the gitstatus/install script fetches the release archive with curl -k, which disables TLS certificate verification for every download attempt, not only as a fallback.

The checksum check can fail open. The script verifies the archive with shasum, sha256sum or sha256. If none of those tools is installed, the check on the first download attempt passes anyway. An attacker in a position to intercept the request to the GitHub mirror can then swap in a malicious archive, which runs as gitstatusd under the user's account every time the prompt renders.

The maintainer confirmed the report. The flaw was reported in GitHub issue #2970 on October 13. Maintainer Roman Perepelitsa replied that the analysis is correct and advised users not to run the installer on a system without digest utilities where they may be the target of a man-in-the-middle attack. The issue has been closed, and no new Powerlevel10k release has followed.

What users can do. Make sure shasum or sha256sum is installed before Powerlevel10k fetches gitstatusd, avoid first-time installs on untrusted networks, and check VulnCheck's advisory for any update.