Omnigent
Monthly
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. There is no public exploit identified at time of analysis, but a vendor patch (0.3.0) and the fixing commit are public.
Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session workspace by uploading a crafted agent bundle with an absolute or traversal-containing os_env.cwd value, exposing host filesystem contents and runner environment secrets. The vulnerability chain spans four source files - parser.py, validator.py, resource_registry.py, and os_env.py - and the security boundary collapses specifically when OMNIGENT_RUNNER_WORKSPACE is unset on the runner. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-confirmed fix was released in v0.3.0.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. There is no public exploit identified at time of analysis, but a vendor patch (0.3.0) and the fixing commit are public.
Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session workspace by uploading a crafted agent bundle with an absolute or traversal-containing os_env.cwd value, exposing host filesystem contents and runner environment secrets. The vulnerability chain spans four source files - parser.py, validator.py, resource_registry.py, and os_env.py - and the security boundary collapses specifically when OMNIGENT_RUNNER_WORKSPACE is unset on the runner. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-confirmed fix was released in v0.3.0.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.