CVE-2026-108913: High severity Omarchy omarchy-theme-set vulnerability
Published Oct 11, 2026
·Updated
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.
Affected Software
1 affected component
Omarchy omarchy-theme-set<4.0.1
Event History
Oct 11, 2026
CVE Published
via MITRE·03:50 PM
Data Sourced
via MITRE·03:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Users of Omarchy 4 versions before 4.0.1 who use omarchy-theme-set to install or apply a third-party theme are exposed. The risk arises when the theme originates from an untrusted Git repository.
2
What does an attacker need to exploit it?
An attacker needs to persuade a user to use a malicious third-party theme from an untrusted Git repository. Exploitation requires user interaction and does not require prior privileges.
3
What should be done to remediate the issue?
Upgrade Omarchy to version 4.0.1 or later. Until upgrading is possible, do not install or apply third-party themes from untrusted Git repositories.