{"schema":"threatline.record/2","record":{"id":"CVE-2026-108913","aliases":["GHSA-mxm5-5433-ggf5"],"summary":"omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untr","details":"omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.","categories":["Unclassified"],"product":"Omarchy","vendor":"Omarchy","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108913","source_modified_at":"2026-10-15T02:32:06.833Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Omarchy","vendor":"Omarchy","versions":[{"lessThan":"4.0.1","status":"affected","version":"4.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108913","source_modified_at":"2026-10-15T02:32:06.833Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Omarchy","ecosystem":null},"version":"4.0.1","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00368,"percentile":0.29546,"score_date":"2026-10-23"},"published_at":"2026-10-11T15:50:50.780Z","modified_at":"2026-10-15T02:32:06.833Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108913","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T02:32:06.833Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108913","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/omacom/omarchy/security/advisories/GHSA-mxm5-5433-ggf5"},{"source":"CVE List","url":"https://github.com/omacom/omarchy/pull/7884"},{"source":"CVE List","url":"https://github.com/omacom/omarchy/commit/ef6d9e6605b121df15bf310e630e04f0c1119fc8"},{"source":"CVE List","url":"https://github.com/omacom/omarchy/releases/tag/v4.0.1"},{"source":"CVE List","url":"https://www.aeon.fun/security/advisories/omarchy-theme-install-code-execution"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-13T18:27:51.011721Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T02:32:06.833Z","content_hash":"ddd6f2bc99893bd39b4245a59e23ce898c8a4d2e80b3df985f4b230077c7c96c"}}