omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into… (CVE-2026-108913)

The vulnerability identified as CVE-2026-108913 affects Omarchy 4 versions before 4.0.1. It involves the omarchy-theme-set component, which allows code execution by processing files from third-party themes placed in the ~/.local/state/omarchy/current/theme directory. These files can contain executable content originating from an untrusted Git repository, enabling an attacker to execute arbitrary code. The CVSS 3.1 base score is 7.1, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity with low impact on availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system by leveraging malicious content in third-party themes. This compromises confidentiality and integrity of the system, potentially leading to unauthorized access or control. The availability impact is low.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted third-party themes or placing files from untrusted Git repositories into the ~/.local/state/omarchy/current/theme directory.