The vulnerability in powerlevel10k arises from improper neutralization of escape, meta, or control sequences in the version field of package.json. When the shell prompt renders the package segment, injected raw escape bytes can execute arbitrary terminal control sequences. This issue affects versions from 0 up to and including 1.20.0. The CVSS 4.0 base score is 4.8, indicating medium severity. There is no indication of known exploits in the wild or a vendor-provided patch at this time.

An attacker able to control the version field in package.json can inject terminal control sequences that execute each time the shell prompt is rendered in affected directories. This could lead to unexpected terminal behavior or visual spoofing but does not indicate privilege escalation or direct code execution beyond terminal control sequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using powerlevel10k in directories with untrusted package.json files or sanitize version fields manually to prevent injection of escape sequences.