Description

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T18:16:49.603Z",
  "pubdate": "2026-08-21T18:16:49.603Z",
  "executiveSummary": "Omnigent prior to version 0.3.0 is affected by an arbitrary command execution vulnerability stemming from insufficient validation of agent bundles within the multipart POST /v1/sessions endpoint.\nAn authenticated user can supply a maliciously crafted agent bundle leveraging a tools..callable dotted Python path to achieve remote code execution under the privileges of the runner process.\nSuccessful exploitation allows attackers to execute arbitrary local system commands, exposing sensitive runner files, environment variables, system credentials, workspace data, internal network services, and causing service availability disruptions.\nThe attack requires authentication to the application interface, specifically necessitating the ability to submit agent bundles via the session creation endpoint.\nThis severe security flaw is fully resolved in version 0.3.0 through proper hardening and input validation implemented in the bundle validation logic.",
  "technicalDetails": "The vulnerability resides in the server-side handling of agent bundles processed by the multipart POST /v1/sessions endpoint in Omnigent prior to version 0.3.0.\nThe root cause of the vulnerability is located in omnigent/server/bundles.py within the validate_agent_bundle function, which fails to adequately restrict or reject dangerous dotted Python paths provided in the tools..callable parameter of an agent bundle.\nDuring the execution phase, omnigent/runner/tool_dispatch.py processes these specifications; specifically, the _resolve_spec_callable function dynamically imports the specified Python module, and _execute_spec_callable_tool subsequently invokes the resolved function.\nAn attacker exploits this lack of input sanitization by supplying a crafted agent bundle that references sensitive system execution utilities, such as subprocess.check_output, as the callable target.\nThe step-by-step attack flow begins with an authenticated user submitting a malicious multipart POST request to /v1/sessions containing the weaponized agent bundle configuration.\nUpon ingestion, the server validates the bundle via omnigent/server/bundles.py without blocking the dangerous dotted path.\nThe runner component then invokes _resolve_spec_callable to import the targeted standard library module and executes it via _execute_spec_callable_tool.\nThis behavior results in arbitrary command execution directly within the context and permissions of the runner process.\nPost-exploitation impact includes unauthorized access to system files, exposure of confidential environment variables and credentials, exfiltration of workspace data, pivoting to internal services, and potential degradation of system availability, all achieved without requiring administrator privileges."
}