@wisha it is reasonable than an rpm or deb package execute arbitrary code, but one would expect that a theme is limited to copying files to specific folders, and maybe call some very specific apis.