---
id: CVE-2026-75483
title: >-
  powerlevel10k fails to neutralize control characters in the package.json
  version field when rendering the package prompt segment
summary: >-
  powerlevel10k fails to neutralize control characters in the package.json
  version field when rendering the package prompt segment. Attackers can inject
  raw escape bytes in the version string to emit arbitrary terminal control
  sequences on…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-150
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75483'
references:
  - url: 'https://github.com/romkatv/powerlevel10k'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/romkatv/powerlevel10k/blob/master/internal/p10k.zsh'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/romkatv/powerlevel10k/commit/58e13d16a50e1d6908e39e20a670896808ccf350
    label: disclosure@vulncheck.com
  - url: 'https://github.com/romkatv/powerlevel10k/issues/2961'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/powerlevel10k-control-character-injection-via-package-json-version
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00171
epssPercentile: 0.05765
ingestedAt: '2026-09-24T20:51:40.207Z'
---

## Overview

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.