CVE-2026-110102: Download of Code Without Integrity Check in romkatv powerlevel10k

CVE-2026-110102 affects Powerlevel10k through version 1.20.0. The vulnerability is in the gitstatus/install script where TLS certificate verification is disabled using curl -k, and integrity checks are skipped if a SHA-256 utility is unavailable. This enables a network-positioned attacker to intercept the download request from github.com and replace the legitimate archive with a malicious one. The malicious code runs as the gitstatusd daemon under the user's account on every prompt, potentially leading to code execution with user privileges.

An attacker positioned on the network can perform a man-in-the-middle attack to deliver malicious code during the installation or update process of gitstatus. This code executes with the privileges of the user running Powerlevel10k, potentially compromising the user's environment and data.

No explicit patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions or ensure downloads occur over trusted networks. Verifying the integrity of downloaded files manually or using a SHA-256 utility can help mitigate risk.