EUVD-2026-64018
GHSA-756x-9hf6-q4h4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Omnigent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.
Articles & Coverage 1
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Omnigent's multi-tenant runner (versions prior to 0.3.0) contains a remote code execution vulnerability allowing any authenticated user to execute arbitrary code with runner process privileges. In shared deployments, this creates privilege escalation risk enabling attackers with valid credentials to compromise all organizations sharing the same runner and access their sensitive data.
Begin within 24 hours by auditing all Omnigent deployments to identify instances running versions prior to 0.3.0 and document affected systems. Within 7 days, test Omnigent version 0.3.0 in a staging environment and deploy it across all affected production instances. Complete all upgrades within 30 days, verify successful deployment, and document closure in your vulnerability tracking system.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an au
Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to
Exploit-DB