Omnigent CVE-2026-112015

Requires an authenticated user who can upload an agent bundle to the Omnigent server (PR:L). The attacker-controlled bundle must define a nested sub-agent (or terminal) whose os_env.cwd is an absolute path or contains '..'; the pre-0.14.0 validation in bundles.py only checked the root agent's cwd, so nested specs bypassed it. The most severe host-filesystem read/write exposure arises on a runner that does NOT have OMNIGENT_RUNNER_WORKSPACE configured, where the supplied cwd becomes the environment root and copytree source (this is the AT:P attack requirement). Limiting factors: valid authentication plus bundle-upload rights are mandatory, exploitation is confined to the runner user's privileges, trusted local runs intentionally retain absolute-cwd behavior, and only versions 0.3.0 through 0.13.x are affected (fixed in 0.14.0).

This is a genuine but access-gated vulnerability rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (7.7 High) shows AV:N and UI:N with full High impact on confidentiality, integrity and availability (VC:H/VI:H/VA:H), which looks severe, but two metrics temper it: PR:L means the attacker must already be an authenticated user with bundle-upload capability, and AT:P indicates a specific attack requirement - the code comments confirm the host-filesystem exposure is most acute on a runner without OMNIGENT_RUNNER_WORKSPACE set, where the uploaded cwd becomes the environment root and copytree source. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified; per the precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent (network-reachable upload surface, authenticated low-priv actor, config-dependent host exposure), so there is no contradiction to flag - the main missing data are EPSS and any SSVC/automatability assessment. Real priority is moderate-to-high specifically for operators running Omnigent in multi-tenant or untrusted-bundle-upload mode; single-user or trusted-local deployments face little practical risk.

An authenticated user with permission to upload an agent bundle crafts a bundle whose nested sub-agent sets os_env.cwd to an absolute path or one containing '..'. Because the pre-patch root-only check in bundles.py never recursed into sub-agents or terminals, the sub-agent's working directory escapes the workspace sandbox, letting the attacker read and write arbitrary host files as the runner user. No public exploit was identified in the provided data.