← Database

CVE-2026-122136

MEDIUM CVSS: 4.4 Published: 2026-11-04 Modified: 2026-11-04

Description

Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-- in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.

Affected Platforms

Unknown

Weakness Type

CWE-59

References