CVE-2026-108913 Omarchy CVE debrief

Who should care

Defenders responsible for Omarchy installations, particularly those using third-party themes, should assess exposure and prioritize verification and updates. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the affected scope, severity, and vendor guidance to ensure the security of their systems.

Why it matters

CVE-2026-108913 is a high-severity vulnerability in Omarchy 4 before 4.0.1 that allows code execution via a third-party theme, emphasizing the need for defenders to verify and update installations, and restrict third-party theme installation.

• Potential code execution via third-party themes
• Need to verify and update Omarchy installations to version 4.0.1 or later
• Importance of restricting third-party theme installation to trusted sources

Technical summary

The vulnerability exists in Omarchy 4 before 4.0.1 and allows code execution via a third-party theme because files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository. This vulnerability emphasizes the need for defenders to verify and update installations, restrict third-party theme installation, and monitor for suspicious activity related to theme installation and execution. The affected product context is Omarchy 4 before 4.0.1, and the defensive impact is the potential for code execution.

Defensive priority

Defenders should prioritize verifying and updating Omarchy installations to version 4.0.1 or later, and restrict the installation of third-party themes to trusted sources.

Recommended defensive actions

• Verify and update Omarchy installations to version 4.0.1 or later
• Restrict the installation of third-party themes to trusted sources
• Monitor for suspicious activity related to theme installation and execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide limited information about the vulnerability, but indicate that it is a high-severity issue that allows code execution. The vulnerability exists in Omarchy 4 before 4.0.1 and allows code execution via a third-party theme because files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository. Defenders should verify the vulnerability details through the official CVE record and source item, and review the affected scope, severity, and vendor

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.