Threats tagged 'ghsa-pfwr-f3c5-mfgm'

Powerlevel10k versions before 1.20.19 have a vulnerability in the bundled gitstatus/install script where an insecure temporary directory is reused if mktemp fails. Local attackers can exploit this by pre-creating a predictable temporary directory named gitstatus-install.tmp, allowing them to replace the extracted gitstatusd binary. This malicious binary then executes with the victim's privileges, potentially leading to privilege escalation.