{"id":"CVE-2026-108913","title":"omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.","summary":"omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","cwe":["CWE-829"],"published":"2026-10-11","updated":"2026-10-11","sourceUpdated":"2026-10-11T16:16:31.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108913","references":[{"url":"https://github.com/omacom/omarchy/commit/ef6d9e6605b121df15bf310e630e04f0c1119fc8","label":"cve@mitre.org"},{"url":"https://github.com/omacom/omarchy/pull/7884","label":"cve@mitre.org"},{"url":"https://github.com/omacom/omarchy/releases/tag/v4.0.1","label":"cve@mitre.org"},{"url":"https://github.com/omacom/omarchy/security/advisories/GHSA-mxm5-5433-ggf5","label":"cve@mitre.org"}],"tags":["nvd"],"ingestedAt":"2026-10-12T14:50:34.065Z","slug":"CVE-2026-108913","body":"## Overview\n\nomarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}