Is CVE-2026-110102 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110102 being exploited in the wild.

How severe is CVE-2026-110102?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Romkatv Powerlevel10k through 1.20.0.

Is there a fix for CVE-2026-110102?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110102 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110102?

Check whether you run Romkatv Powerlevel10k at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110102: Powerlevel10k insecure download in gitstatus installation script

CVE-2026-110102 · Severity: high · CVSS 7.5 · Published 2026-10-13

Powerlevel10k is a theme for the Zsh shell used to customize terminal appearance. Versions through 1.20.0 install a daemon called gitstatusd via a script that does not verify the authenticity of downloaded files. An attacker on the network can intercept the download, replace it with malicious code, and gain execution as the user every time the shell prompt is displayed.

Technologies: Romkatv Powerlevel10k. Vendors: Romkatv.

Quick answers

Is CVE-2026-110102 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110102 being exploited in the wild.
How severe is CVE-2026-110102?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Romkatv Powerlevel10k through 1.20.0.
Is there a fix for CVE-2026-110102?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110102 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110102?: Check whether you run Romkatv Powerlevel10k at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The gitstatus/install script uses curl -k to disable TLS certificate verification and fails to validate SHA-256 checksums if no checksum utility is available on the system. This allows network-positioned attackers to perform man-in-the-middle attacks on downloads from github.com, substitute a malicious archive, and achieve arbitrary code execution as the gitstatusd daemon under the user's privileges on every prompt.

Affected products

romkatv Powerlevel10k through 1.20.0

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.