CVE-2026-108913 Details
Description
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.
A code execution vulnerability exists in the Omarchy application, specifically in versions prior to 4.0.1, within the 'omarchy-theme-set' component. The issue arises when a user installs a third-party theme from an untrusted Git repository using 'omarchy theme install'. The vulnerability allows the execution of arbitrary code because the theme files, including executable content, are copied into a directory where they can be executed by the user. This exploitation occurs immediately upon theme installation and can also be triggered later when the user logs in or opens certain applications.
Users can upgrade to Omarchy version 4.0.1 or later, which includes the fix for this vulnerability. The update can be applied through the Omarchy menu or by downloading the latest version from the Omarchy GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/omacom/omarchy/commit/ef6d9e6605b121df15bf310e630e04f0c1119fc8 | [email protected] | Source CodeVendor |
| https://github.com/omacom/omarchy/pull/7884 | [email protected] | Issue TrackingVendor |
| https://github.com/omacom/omarchy/releases/tag/v4.0.1 | [email protected] | Release NotesVendor |
| https://github.com/omacom/omarchy/security/advisories/GHSA-mxm5-5433-ggf5 | [email protected] | AdvisoryBroken LinkVendor |
| https://www.aeon.fun/security/advisories/omarchy-theme-install-code-execution | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Omarchy | 4.0.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | [email protected] |
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |