TripleU613 closed the Tormarchy 1.2.0 marketplace verification request after HANCORE-linux identified a passwordless privilege escalation path in the submitted commit. The reviewer reported that a broadly authorized program entry allowed browser-exec to run caller-supplied commands as root. This was a withdrawn verification request, not publication of a verified update. omacom/omarchy-plugin-marketplace#11155
TripleU613 confirmed the finding and reported an upstream fix restricting privileged entry points to specific subcommands and refusing browser execution as root. The author said a new request would follow for a release containing the fix. That response establishes a reported correction, without establishing marketplace verification of the replacement. omacom/omarchy-plugin-marketplace#11155:issuecomment-6125303525
