Omarchy
Monthly
Omarchy 4 before 4.0.1 stages files from third-party themes without filtering executable content, so installing a theme from an untrusted Git repository and applying it with omarchy-theme-set lets the theme author run code as the victim user: Hyprland loads a theme's hyprland.lua and gum_env.lua at login, Neovim loads neovim.lua at startup, terminal configs (alacritty.toml, foot.ini, ghostty.conf, kitty.conf) name the program the terminal launches, and vscode.json installs an arbitrary VS Code extension. The CVSS 7.1 rating is tempered by the deliberate user action required - a user must choose to install and apply an attacker-supplied theme (UI:R, no credentials needed, PR:N) - and by the confinement of the resulting code to the victim's own privileges rather than root, which places real-world urgency at moderate-to-low rather than drop-everything. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor shipped a fix in the v4.0.1 release, and users who only apply bundled or self-authored themes are not exposed.
Omarchy 4 before 4.0.1 stages files from third-party themes without filtering executable content, so installing a theme from an untrusted Git repository and applying it with omarchy-theme-set lets the theme author run code as the victim user: Hyprland loads a theme's hyprland.lua and gum_env.lua at login, Neovim loads neovim.lua at startup, terminal configs (alacritty.toml, foot.ini, ghostty.conf, kitty.conf) name the program the terminal launches, and vscode.json installs an arbitrary VS Code extension. The CVSS 7.1 rating is tempered by the deliberate user action required - a user must choose to install and apply an attacker-supplied theme (UI:R, no credentials needed, PR:N) - and by the confinement of the resulting code to the victim's own privileges rather than root, which places real-world urgency at moderate-to-low rather than drop-everything. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor shipped a fix in the v4.0.1 release, and users who only apply bundled or self-authored themes are not exposed.