EUVD-2026-64014Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Unauthorized commits to production repositories constitute High integrity impact; PR:L reflects required agent session; no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.
AnalysisAI
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two initial access conditions: (1) authenticated low-privilege access to an Omnigent agent session (consistent with CVSS PR:L), or (2) successful prompt injection into an agent's instruction stream via untrusted content the agent processes (e.g., a malicious repository file, issue body, or web page). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, score 7.1) reflects network-accessible exploitation requiring only low-privilege agent credentials with no user interaction and low complexity - a combination that warrants prompt action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Omnigent 0.3.0, released at https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0 and patched via commit 1a05b7b139ef504bf2be89bf37918abe104fb95c (PR #389). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Omnigent deployments to identify current versions and document access credentials, particularly GitHub token permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an au
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by up
Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today