Powerlevel10k up to version 1.20.0 contains an insecure download step in its gitstatus installer where TLS certificate verification is disabled by using curl ‑k and integrity checks are only performed if a SHA‑256 utility is present. This allows an attacker located between the user and github.com to replace the archive that is downloaded during the installation or update process with malicious code. Because the installer runs the downloaded file as gitstatusd under the current user, the attacker can gain code execution on the user’s shell environment, potentially compromising all sessions that invoke gitstatus.

The vulnerability affects the romkatv:powerlevel10k repository, specifically releases up through 1.20.0. Any system that has installed this theme and subsequently runs the gitstatus installer, either during initial setup or on each prompt, is potentially impacted. The issue is tied directly to the gitstatus/install script of powerlevel10k.

The CVSS score is 7.7, indicating a high severity. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but its impact would allow a network‑positioned attacker that can intercept traffic to github.com to perform code execution as the local user. The exploit relies on the lack of certificate verification and the absence of checksum verification, making it relatively straightforward for an attacker with network access to substitute a malicious archive during download.