{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apowerlevel10k_projectpowerlevel10k/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:powerlevel10k_project:powerlevel10k:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110102"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Powerlevel10k (\u003c= 1.20.0)"],"_cs_severities":["high"],"_cs_tags":["insecure-download","code-execution","shell-security","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Powerlevel10k"],"content_html":"\u003cp\u003ePowerlevel10k, a popular theme for the Zsh shell, contains a critical vulnerability in its \u003ccode\u003egitstatus/install\u003c/code\u003e script affecting versions up to 1.20.0. The installation process for the \u003ccode\u003egitstatus\u003c/code\u003e component utilizes \u003ccode\u003ecurl -k\u003c/code\u003e to download binaries, effectively disabling TLS certificate validation. Furthermore, the script skips essential integrity checks if the \u003ccode\u003esha256sum\u003c/code\u003e utility is not present on the system. These design flaws allow a network-positioned attacker to perform a man-in-the-middle (MitM) attack, intercepting the request to the download mirror and substituting a malicious archive. Once the script completes, the malicious binary is executed as the \u003ccode\u003egitstatusd\u003c/code\u003e daemon with the privileges of the user who initiated the shell session. Given that \u003ccode\u003egitstatusd\u003c/code\u003e is invoked on every shell prompt, this results in persistent, unauthorized code execution within the user's environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a network-positioned vantage point between the victim and the download mirror.\u003c/li\u003e\n\u003cli\u003eVictim executes a command triggering the \u003ccode\u003egitstatus/install\u003c/code\u003e script, such as initializing or updating the shell theme.\u003c/li\u003e\n\u003cli\u003eAttacker intercepts the HTTPS request initiated by the insecure \u003ccode\u003ecurl -k\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eAttacker returns a malicious binary archive instead of the legitimate \u003ccode\u003egitstatusd\u003c/code\u003e component.\u003c/li\u003e\n\u003cli\u003eThe script extracts the malicious binary to the local filesystem without performing integrity validation.\u003c/li\u003e\n\u003cli\u003eThe shell theme executes the malicious file, establishing it as the persistent \u003ccode\u003egitstatusd\u003c/code\u003e daemon.\u003c/li\u003e\n\u003cli\u003eEvery time the victim opens a terminal or executes a command, \u003ccode\u003egitstatusd\u003c/code\u003e runs malicious code under the user's account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution under the privileges of the victim's user account. This impact is persistent across terminal sessions, potentially leading to full account compromise, credential theft, and lateral movement within the environment. This vulnerability affects any environment utilizing Powerlevel10k versions 1.20.0 or older, including developer workstations and server environments configured with this theme.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Powerlevel10k to a version beyond 1.20.0 immediately.\u003c/li\u003e\n\u003cli\u003eAudit user home directories for the existence of \u003ccode\u003egitstatusd\u003c/code\u003e binaries that do not match known cryptographic hashes.\u003c/li\u003e\n\u003cli\u003eEnsure that \u003ccode\u003esha256sum\u003c/code\u003e or equivalent integrity verification utilities are installed and functional on all systems to prevent fallback to insecure installation modes.\u003c/li\u003e\n\u003cli\u003eRestrict outgoing network connections from servers and workstations to prevent unauthorized communication with unknown download mirrors.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-13T18:37:20Z","date_published":"2026-10-13T18:37:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-powerlevel10k-insecure-download/","summary":"Powerlevel10k versions through 1.20.0 execute malicious code via an insecure gitstatus installation script that disables TLS certificate verification and lacks integrity checks.","title":"Insecure Download Vulnerability in Powerlevel10k gitstatus Component","url":"https://feed.craftedsignal.io/briefs/2026-10-powerlevel10k-insecure-download/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:powerlevel10k_project:powerlevel10k:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}