63 matches found
CVE-2026-112015
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
omnigent-client (>=0.13.0, <=0.14.0rc1), omnigent-ui-sdk (>=0.13.0, <=0.14.0rc1) potentially affected by CVE-2026-112015 via omnigent (>=0.13.0, <=0.14.0rc1)
omnigent PYPI version =0.13.0, =0.13.0, =0.13.0, =0.14.0rc1 Source cves: CVE-2026-112015 Source advisory: MEND:CVE-2026-112015...
CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
EUVD-2026-103468
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
CVE-2026-112015
Omnigent versions 0.3.0 before 0.14.0 are vulnerable to a path traversal vulnerability (CWE-22). The flaw exists because authenticated users can escape the workspace by setting os_env.cwd on nested sub-agents. By uploading a bundle whose sub-agent specifies an absolute or parent-traversing workin...
CVE-2026-112015
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
CVE-2026-112015: Improper Limitation of a Pathname to a Restricted Directory
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
PT-2026-116619
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only...
Omnigent path traversal vulnerability
In versions prior to Omnigent 0.14.0 and 0.3.0, there was a path traversal vulnerability. This vulnerability stems from path traversal attacks. Certified users can escape the working directory by setting up nested sub-proxies in os.env.cwd. They can also upload bundles that utilize absolute or...
PYSEC-2026-3872 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and...
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
SummaryAn authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent.Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding ...
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
SummaryAn authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundle...
PYSEC-2026-3874 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...
PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
PYSEC-2026-3875 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeonProject: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing"Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
SummaryAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.When the tool is invoked, the runner imports and...