CVE-2026-108913
Received Received - Intake

Code Execution via Untrusted Theme in Omarchy

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: MITRE

Description
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108913
EUVD
EUVD-2026-97101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Omarchy Omarchy 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows code execution through third-party themes in Omarchy 4 before version 4.0.1. Attackers can place executable files into the theme directory via an untrusted Git repository, enabling arbitrary code to run on the system.

Detection Guidance

Check for themes in ~/.local/state/omarchy/current/theme with executable files like Lua scripts or terminal configs. Inspect Git repositories in theme directories for untrusted sources. Validate theme names and paths for symlinks or path traversal attempts.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially stealing data, installing malware, or gaining unauthorized access. It specifically targets themes installed from untrusted sources.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing arbitrary code execution through untrusted themes. If exploited, it may lead to unauthorized data access, modification, or exfiltration, which are critical violations under these regulations.

Mitigation Strategies

Upgrade to Omarchy v4.0.1 or later via the Update menu or fresh ISO install. Remove executable files from existing themes in ~/.local/state/omarchy/current/theme. Verify theme sources are trusted and not from untrusted Git repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart