omarchy-theme-set in Omarchy 4 prior to version 4.0.1 enables an attacker to execute arbitrary code by embedding malicious files within a third‑party theme. The vulnerability arises because files placed into the user‑specific directory ~/.local/state/omarchy/current/theme can originate from an untrusted Git repository, allowing executable content to be included without validation. If an attacker can provide a theme or manipulate the content of that directory, they can run code with the permissions of the receiving Omarchy process.

Any installation of Omarchy 4.x that utilizes third‑party themes and stores theme files in ~/.local/state/omarchy/current/theme is affected. The issue exists in all releases before v4.0.1 and was fixed in v4.0.1 and later releases.

The flaw has a CVSS base score of 7.1, indicating a high severity, and it is not listed in the CISA KEV catalog. Exploitation requires the ability to supply or replace theme files in the target user’s configuration directory, which may be accomplished by an attacker who can upload a malicious theme or modify the repository that provides the theme’s content. Once the malicious files are present, the attacker can execute code with the same privileges as the installed Omarchy application, potentially compromising the local user’s environment.