CVE-2026-62677 in Omnigent
Summary
by MITRE • 08/21/2026
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within the Omnigent AI agent framework represents a critical path traversal and arbitrary file read/write flaw that stems from insufficient input validation during session initialization. Omnigent serves as an open-source meta-harness for orchestrating coding agents, relying on specific configuration parameters to define operational boundaries. In versions prior to 0.3.0, the system fails to adequately sanitize or constrain the os_env.cwd value provided by authenticated users when uploading a session-scoped agent bundle. The parser module stores this value verbatim without applying necessary normalization checks for absolute paths or directory traversal sequences such as dot-dot-slash patterns. This lack of constraint allows an attacker to manipulate the working directory context, effectively bypassing intended isolation mechanisms that are supposed to keep agent operations confined within a designated workspace.
The operational impact is severe due to how the runner component processes this manipulated configuration. When the environment variable OMNIGENT_RUNNER_WORKSPACE is unset, which may occur in certain deployment configurations or local development environments, the resource registry preserves the attacker-controlled path without redirection to a safe default location. Consequently, the inner operating system environment module utilizes this resolved, maliciously crafted path as both the root for environmental operations and the source directory for file copying via tree functions. This architectural decision means that any subsequent tool invocation relying on these paths operates from an arbitrary filesystem location rather than the intended sandboxed workspace. The security control known as _assert_within_cwd is rendered ineffective because it validates actions against the attacker-selected root, which the system incorrectly treats as trusted and safe for execution.
This flaw enables a range of malicious activities including unauthorized file reads, writes, edits, and shell command executions outside the permitted boundaries. An authenticated user can leverage this vulnerability to access sensitive runner files, environment secrets, or other critical infrastructure components that should remain isolated from agent operations. The ability to execute arbitrary commands through shell tools further exacerbates the risk, potentially leading to full system compromise if the execution context possesses elevated privileges. This behavior aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-78 OS Command Injection, as it allows an actor to bypass directory restrictions and execute commands in unintended contexts. From a threat modeling perspective using MITRE ATT&CK techniques, this vulnerability facilitates lateral movement within the host environment and credential access through unauthorized file reads, undermining the principle of least privilege essential for secure AI agent orchestration.
The issue was addressed in version 0.3.0 by implementing stricter validation logic to ensure that all path inputs are normalized and constrained relative to a predefined safe workspace root. To mitigate this risk in affected systems, organizations should immediately upgrade to Omnigent version 0.3.0 or later where the parser and validator modules enforce proper boundary checks on directory paths. Additionally, administrators should ensure that the OMNIGENT_RUNNER_WORKSPACE environment variable is explicitly set to a secure, isolated directory path even if default behaviors are patched, providing an additional layer of defense-in-depth. Regular auditing of agent bundle configurations and restricting upload permissions to trusted sources can further reduce the attack surface associated with session-scoped resource management in AI orchestration frameworks.