Omarchy CVE-2026-108913

Exploitation requires the victim to install a theme from an untrusted/third-party Git repository via 'omarchy theme install' and then apply it with omarchy-theme-set on Omarchy 4 prior to 4.0.1. The code runs because, before the fix, theme files that name or load programs were staged unchecked: any .lua file (hyprland.lua and gum_env.lua loaded by Hyprland at login, neovim.lua at Neovim startup), terminal configs that specify the launched program (alacritty.toml, foot.ini, ghostty.conf, kitty.conf), and vscode.json (which installs an arbitrary VS Code extension). LIMITING FACTORS: the attack is gated on deliberate user action (installing and applying an attacker-supplied theme - UI:R), is confined to Omarchy versions before 4.0.1, and only yields the victim user's own privileges (not root). Users who only use bundled/trusted themes are not exposed.

This is a High-scored (CVSS 7.1) code-execution flaw, but the composite signals point to moderate-to-low real-world urgency rather than a drop-everything priority. The impact metrics are what inflate the score - C:H/I:H reflect arbitrary code running in the victim's user context (CWE-829, inclusion of functionality from an untrusted control sphere) - while the exploitability metrics heavily constrain it: AC:H and UI:R mean the victim must deliberately fetch and apply a theme from an attacker-controlled Git repository. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or automatable exploitation; this behaves as a trust-boundary/social-engineering issue, not a remotely triggerable network service bug. CONFLICTING SIGNAL: the NVD vector asserts AV:N, yet the vulnerability actually fires when Omarchy locally processes/stages files from a theme the user already installed - the 'network' aspect is only that the malicious content is hosted in a Git repo the victim chooses to clone. This is closer to a malicious-file (AV:L) scenario, so the AV:N framing overstates remote reach - verify against the vendor advisory. Net: a legitimate RCE worth patching to 4.0.1, but exploitation depends entirely on a user opting into untrusted themes, and the affected product has a small footprint.

An attacker publishes a malicious Omarchy theme in a public Git repository and promotes it (forum, social post, theme list). A victim runs 'omarchy theme install <url>' and applies it; the theme ships executable payloads - a hyprland.lua/neovim.lua, a terminal config (e.g. alacritty.toml/kitty.conf) that names the program the terminal launches, or a vscode.json that installs an arbitrary VS Code extension - which execute in the victim's session. No public exploit code was identified, though the fix PR #7884 documents the exact mechanisms abused.