powerlevel10k gitstatus Auto-Installer TLS Verification Bypass and RCE #2970

Vulnerability Overview Title: [Security] gitstatus Auto-Installer Disables TLS Certificate Verification and Fails Open on Checksum Verification When No Digest Utility Is Present #2970 Description: When 's native daemon needs to be installed (i.e., there is no matching cached binary for the current version/platform), the function in uses to download the release archive, completely disabling TLS certificate verification. The downloaded archive is subsequently validated using , but its comparison logic contains a fail-open condition: for the first mirror attempt, if no digest utility ( , , or ) is supported, an empty result hash is treated as passing rather than failing. The accepted archive is extracted and directly moved into the executable daemon cache, where it runs as a native binary on the user's shell. Impact Scope Affected Versions: Confirmed against the current default branch as of 2026-10-13. Specific Impact: On systems lacking digest utilities, the auto-installation path (triggered when no cached daemon exists for the current version/platform) allows network-location attackers to intercept or redirect downloads from the primary mirror. Since completely disables TLS certificate verification (disabling it unconditionally for every fetch), an attacker can substitute the archive with an arbitrary file. The installer accepts it without integrity checks and installs it as an executable that runs during every subsequent prompt rendering in the user shell context, resulting in arbitrary code execution. Remediation Current Status: The issue has been marked as closed. confirmed the analysis is correct and recommended avoiding running the installer on systems lacking digest utilities to mitigate the risk of man-in-the-middle attacks. POC Code Summary This vulnerability involves the auto-installer for completely disabling TLS certificate verification and checksum validation when digest utilities are missing, leading to a risk of arbitrary code execution. The recommended remediation is to avoid running the installer on systems that lack digest utilities.

Goal Reached Thanks to every supporter — we hit 100%!

powerlevel10k gitstatus Auto-Installer TLS Verification Bypass and RCE #2970

More from this source