CVE-2026-108913

high

Description

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.

References

https://github.com/omacom/omarchy/security/advisories/GHSA-mxm5-5433-ggf5

https://github.com/omacom/omarchy/releases/tag/v4.0.1

https://github.com/omacom/omarchy/pull/7884

https://github.com/omacom/omarchy/commit/ef6d9e6605b121df15bf310e630e04f0c1119fc8

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97101

Details

Source: Mitre, NVD

Published: 2026-10-11

Updated: 2026-10-11

Risk Information

CVSS v2

Base Score: 7.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P

Severity: High

CVSS v3

Base Score: 7.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L