kanpianer's EasyOpenVPN submission, omacom/omarchy-plugin-marketplace#13434, remains open. The widget offers profile management, connection controls and an optional passwordless Polkit helper. kanpianer reported adding immutable configuration snapshots after an earlier review found mutable profiles could introduce root-loaded plugins.
HANCORE-linux found the revised implementation still validated the writable profile before copying it, leaving the copied bytes unvalidated. omacom/omarchy-plugin-marketplace#13434:issuecomment-6537843460 therefore reports the privilege-escalation race remaining at the reviewed commit. A further review found server-controlled log markup could trigger network requests when displayed. The supplied record establishes these findings, without a later confirmed fix.
