CVE-2026-62677: falha de alta gravidade em omnigent-ai omnigent
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.6%
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
omnigent-ai · omnigentCVEs relacionadas — omnigent-ai omnigent
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62675HIGHOmnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable ToolsEPSS 0.7%CVE-2026-62674CRITICALOmnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCEEPSS 0.5%CVE-2026-112015HIGHOmnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwdEPSS 0.4%CVE-2026-62676HIGHOmnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.pyEPSS 0.4%