CVE-2026-122137Medium· 6.7▾ SunlitPowerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gits…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.
powerlevel10k < 1.20.19gitstatus <= 1.5.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-122136Medium· 4.4Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File
CVE-2026-110102High· 7.5Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists
CVE-2026-104657High· 7.5Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill
CVE-2026-73585Medium· 6.3Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack
CVE-2026-73584Medium· 6.3Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling
CVE-2026-121549Medium· 4.4nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins