CVE-2026-75483

LowCVSS 3.3/10Last modified Oct 23, 2026

Description

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-150

Affected software

No affected versions have been published.

Timeline

Published
Aug 17, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-754846.9Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smCVE-2026-754855.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in rCVE-2026-754868.0Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuratioCVE-2026-75497.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?actiCVE-2026-754967.2Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible CVE-2026-754977.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privilegesCVE-2026-754987.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privilegesCVE-2026-75507.3A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.CVE-2026-755056.0EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission cCVE-2026-755077.5GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMeCVE-2026-755087.5GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limiCVE-2026-755096.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version