Description
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Omarchy Omarchy
Default version status: unaffected
4.0.0 to < 4.0.1affected
References
- https://github.com/omacom/omarchy/security/advisories/GHSA-mxm5-5433-ggf5 ↗
- https://github.com/omacom/omarchy/pull/7884 ↗
- https://github.com/omacom/omarchy/commit/ef6d9e6605b121df15bf310e630e04f0c1119fc8 ↗
- https://github.com/omacom/omarchy/releases/tag/v4.0.1 ↗
- https://www.aeon.fun/security/advisories/omarchy-theme-install-code-execution ↗