# CVE-2026-122136: Powerlevel10k symlink following in prompt dump

Source: https://junglewise.ai/threats/cve-2026-122136-powerlevel10k-before-1-20-19-contains-a-symlink-following  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-122136 · Severity: medium · CVSS 4.4 · Published 2026-11-04

Powerlevel10k is a Zsh shell theme that customizes the command-line prompt. Before version 1.20.19, the theme's instant prompt feature creates temporary files with predictable names in the system temp directory. An attacker can pre-plant symlinks to trick the shell into overwriting any file the user can write to during shell startup.

Technologies: [Romkatv Powerlevel10k](https://junglewise.ai/threats/technologies/powerlevel10k). Vendors: [Romkatv](https://junglewise.ai/threats/vendors/romkatv).

## Quick answers

**Is CVE-2026-122136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122136 being exploited in the wild.

**How severe is CVE-2026-122136?** Medium severity, with a CVSS score of 4.4, published 4 November 2026.

**Which products and versions are affected?** Romkatv Powerlevel10k before 1.20.19.

**Is there a fix for CVE-2026-122136?** Yes: fixed in 1.20.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122136 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-122136?** Check whether you run Romkatv Powerlevel10k at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.20.19

## Technical details

The vulnerability is a classic symlink-following flaw in the _p9k_dump_instant_prompt function. It creates temporary files named p10k-instant-prompt-output-<user>-<pid> without checking for symlinks. An attacker can pre-create symlinks pointing to victim-writable files and guess or brute-force the PID, causing the shell to truncate and overwrite the target files during startup.

## Affected products

- romkatv Powerlevel10k before 1.20.19

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/romkatv/powerlevel10k](https://github.com/romkatv/powerlevel10k)
- [https://github.com/romkatv/powerlevel10k/blob/v1.20.0/internal/p10k.zsh](https://github.com/romkatv/powerlevel10k/blob/v1.20.0/internal/p10k.zsh)

## Related threats

- [Powerlevel10k insecure temporary directory in gitstatus installer](https://junglewise.ai/threats/cve-2026-122137-powerlevel10k-before-1-20-19-contains-an-insecure-temporary)
- [Powerlevel10k insecure download in gitstatus installation script](https://junglewise.ai/threats/cve-2026-110102-powerlevel10k-through-1-20-0-contains-an-insecure-download)