CVE-2026-108913

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-11 · updated 2026-10-16
Weakness: CWE-829

Description

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.

Affected products

Omarchy: from 4.0.0 before 4.0.1 — fixed in 4.0.1

How to fix

Upgrade to a fixed version: Omarchy 4.0.1. Check the vendor advisory for mitigations.

References

https://github.com/omacom/omarchy/commit/ef6d9e6605b121df15bf310e630e04f0c1119fc8
https://github.com/omacom/omarchy/pull/7884
https://github.com/omacom/omarchy/releases/tag/v4.0.1
https://github.com/omacom/omarchy/security/advisories/GHSA-mxm5-5433-ggf5
https://www.aeon.fun/security/advisories/omarchy-theme-install-code-execution

Get alerted when CVE-2026-108913 or the next vulnerability affects your stack