Attack Chain

1. Attacker establishes a network-positioned vantage point between the victim and the download mirror.
2. Victim executes a command triggering the gitstatus/install script, such as initializing or updating the shell theme.
3. Attacker intercepts the HTTPS request initiated by the insecure curl -k command.
4. Attacker returns a malicious binary archive instead of the legitimate gitstatusd component.
5. The script extracts the malicious binary to the local filesystem without performing integrity validation.
6. The shell theme executes the malicious file, establishing it as the persistent gitstatusd daemon.
7. Every time the victim opens a terminal or executes a command, gitstatusd runs malicious code under the user's account.

Impact

Successful exploitation results in arbitrary code execution under the privileges of the victim's user account. This impact is persistent across terminal sessions, potentially leading to full account compromise, credential theft, and lateral movement within the environment. This vulnerability affects any environment utilizing Powerlevel10k versions 1.20.0 or older, including developer workstations and server environments configured with this theme.

Recommendation

1. Upgrade Powerlevel10k to a version beyond 1.20.0 immediately.
2. Audit user home directories for the existence of gitstatusd binaries that do not match known cryptographic hashes.
3. Ensure that sha256sum or equivalent integrity verification utilities are installed and functional on all systems to prevent fallback to insecure installation modes.
4. Restrict outgoing network connections from servers and workstations to prevent unauthorized communication with unknown download mirrors.