Description
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
romkatv powerlevel10k
Default version status: unaffected
0 to ≤ 1.20.0affected
References
- https://github.com/romkatv/powerlevel10k/issues/2970 ↗
- https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L306-L333 ↗
- https://github.com/romkatv/powerlevel10k/blob/v1.20.0/gitstatus/install#L348 ↗
- https://www.vulncheck.com/advisories/powerlevel10k-through-1.20.0-download-of-code-without-integrity-check-in-gitstatus-installer ↗