CVE-2026-112015

Omnigent versions 0.3.0 before 0.14.0 are vulnerable to a path traversal vulnerability (CWE-22). The flaw exists because authenticated users can escape the workspace by setting os_env.cwd on nested sub-agents. By uploading a bundle whose sub-agent specifies an absolute or parent-traversing workin...