Dashboard / CVE-2026-122136

CVE-2026-122136

MEDIUM
MEDIUM Priority: 0.00 BB Relevance: 23/100
Published: 2026-11-04 Modified: 2026-11-09 First seen: 2026-11-04 Status: active

Attack Surface

Low Complexity Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: Passive
AT: Present
VC: None
VI: High
VA: None

Description

Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
romkatv powerlevel10k 0 < 1.20.19
romkatv powerlevel10k 0 < 1.20.19

References & Advisories (5)

Bug Bounty Relevance

23 / 100
✓ Low complexity

CVSS Score

4.1 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.12%
Raw Score 0.001200
Percentile 1.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00120
2026-11-12
0.00120
2026-11-10
0.00120
2026-11-09
0.00120
2026-11-08
0.00120
2026-11-07
0.00120
2026-11-06
0.00120
2026-11-05
0.00120

Intelligence Sources

mitre ref →
nvd ref →

External Links