{"affected":[{"defaultStatus":"unaffected","product":"powerlevel10k","source":"CNA: VulnCheck","vendor":"romkatv","versions":[{"lessThan":"1.20.19","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-122136","cwes":["CWE-59"],"description":"Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":4.4,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793824614467,"publishedAt":1793824614467,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/romkatv/powerlevel10k/issues/2972"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/romkatv/powerlevel10k"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/romkatv/powerlevel10k/commit/7ddd1b2715c3844275214347a3572ac1fdd6dc39"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/romkatv/powerlevel10k/blob/v1.20.0/internal/p10k.zsh#L6445-L6452"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/powerlevel10k-before-1.20.19-symlink-following-via-instant-prompt-temporary-file"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/romkatv/powerlevel10k/commit/7ddd1b2715c3844275214347a3572ac1fdd6dc39"}],"revision":"7443057d48e0171ec20f091af0a272d4bb576b813cce6a2fa627d79b8d272465","sources":[{"modifiedAt":1793824614467,"name":"CNA: VulnCheck","retrievedAt":1793826730915,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122136"}],"ssvc":null,"status":"published","title":"Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File","updatedAt":1793826730915}