EUVD-2026-64016Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Network endpoint reachable with low complexity; requires an authenticated session-editor (PR:L) and a later victim launch (UI:R); poisoning a shared agent affecting other sessions is a scope change (S:C) yielding full RCE impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent to launch an attacker-controlled command through omnigent/tools/mcp.py. The command executes with the Omnigent runner process permissions and can expose files, credentials, workspace data, internal services, and runner availability. This issue is fixed in version 0.3.0.
AnalysisAI
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account (PR:L per CVSS) that holds edit access (LEVEL_EDIT) to at least one session, and that session must be bound to a shared or template agent whose agent.session_id is None; the attacker abuses PUT /sessions/{session_id}/agent to replace that shared agent bundle and add a stdio MCP server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) reflects a network-reachable, low-complexity attack requiring only low privileges but also user interaction and involving a scope change - the attacker's action in one session affects later, separate sessions using the shared agent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Omnigent 0.3.0, which adds an explicit guard rejecting edits to built-in shared/template agents (agent.session_id is None) via the session agent endpoint (Vendor-released patch: 0.3.0; see release https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0, fix PR https://github.com/omnigent-ai/omnigent/pull/1418, and commit 25a22dc9e6da4648d23749f0a589e47e6aed991b). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Omnigent deployments and identify instances running versions prior to 0.3.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by up
Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today