powerlevel10k does not sanitize control characters in the package.json version field when rendering the package prompt segment. This allows an attacker to embed raw escape bytes that become terminal control sequences every time the prompt is drawn. The resulting sequences can manipulate the terminal screen, change cursor position, hide or reveal text, or send other control instructions, which may subvert user interaction or conceal malicious output. The weakness is classified as CWE-150, related to the improper handling of control characters.

The vulnerability appears in the romkatv:powerlevel10k prompt theme for the ZSH shell. It affects all releases that reference the package.json version string for prompt rendering; the precise version range is unspecified in the advisory, so any current or future release that has not applied the sanitization fix is impacted.

The CVSS base score is 4.8, placing the issue in the moderate range. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating that widespread exploitation has not been reported. Attackers would need local access to modify the package.json file or to influence the prompt rendering environment, so the attack vector is most likely local. Once the malicious value is present, each prompt render emits the injected terminal control sequences, affecting the confidentiality and usability of the terminal session but not compromising kernel or system privileges.