EUVD-2026-64015Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network upload endpoint with authenticated access (PR:L); OMNIGENT_RUNNER_WORKSPACE condition is a common omission in default deploys, supporting AC:L; shell tool access yields full C/I/A against the runner.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.
AnalysisAI
Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session workspace by uploading a crafted agent bundle with an absolute or traversal-containing os_env.cwd value, exposing host filesystem contents and runner environment secrets. The vulnerability chain spans four source files - parser.py, validator.py, resource_registry.py, and os_env.py - and the security boundary collapses specifically when OMNIGENT_RUNNER_WORKSPACE is unset on the runner. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds an authenticated session with bundle-upload permissions on the Omnigent server (CVSS PR:L - this is not unauthenticated exploitation); (2) the target runner has OMNIGENT_RUNNER_WORKSPACE unset in its environment - when this variable is present, resource_registry.py does not preserve the attacker-controlled path and the vulnerability does not reach the filesystem; (3) the server operates with enforce_handler_allowlist=True, which is the default for untrusted multi-user deployments (local/single-user operators with enforce_handler_allowlist=False are explicitly excluded from the new validation by design). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the broad impact - full confidentiality, integrity, and availability - achievable via a network-reachable upload endpoint requiring only authenticated access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Omnigent v0.3.0, available at https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0; this release introduces os_env.cwd validation in bundles.py (PR #1417, commit 7ca0cca3c9a65c04c489edf68f0e080424a26868) that rejects absolute paths and path segments containing '..' for untrusted bundle uploads. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Omnigent AI agent framework deployments and determine current versions across your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an au
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by up
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today