Description

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-21T18:16:49.743Z",
  "pubdate": "2026-08-21T18:16:49.743Z",
  "executiveSummary": "Omnigent prior to version 0.3.0 suffers from a security bypass vulnerability within its shell-command parser implemented in omnigent/policies/builtins/_shell.py.\nThe vulnerability manifests as an insufficient command parsing logic that fails to recognize complex command structures, including combined interpreter flags, wrapper utilities such as timeout, nice, setsid, and stdbuf, command substitutions, and background control operators.\nWhen a gated git push or gh write operation is obfuscated using these unsupported forms, the security policy evaluation fails to parse the underlying operation, causing both the github.py write_repos and write_branches allowlist enforcement and the working_dir.py workspace confinement policies to abstain.\nConsequently, the security controls default to allowing the command to execute without restriction.\nAn authenticated user or a contextually manipulated AI agent utilizing prompt injection techniques can exploit this flaw to bypass repository and branch restrictions, enabling unauthorized pushes to protected repositories or branches.\nFurthermore, attackers can leverage this parsing failure to escape the intended workspace directory constraints defined in working_dir.py.\nThe risk implication is severe as it compromises the core security boundaries enforced by the AI agent framework, allowing unauthorized code modifications and arbitrary command execution outside designated parameters.\nExploitation requires the ability to execute shell commands within the framework, achievable either through direct authentication or indirect prompt injection vectors targeting the coding agent.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate implementation of the shared shell-command parser located in omnigent/policies/builtins/_shell.py prior to version 0.3.0.\nThe parser relies on pattern matching or lexical analysis that is insufficiently robust to handle advanced shell syntax and command wrappers.\nSpecifically, the parser fails to inspect and normalize combined interpreter flags, utility wrappers such as timeout, nice, setsid, and stdbuf, dynamic command substitutions, and single background control operators.\nThe vulnerable components include the shell command inspection module omnigent/policies/builtins/_shell.py, alongside policy enforcement modules github.py (specifically write_repos and write_branches allowlists) and working_dir.py (workspace confinement mechanisms).\nAffected versions comprise all deployments of Omnigent prior to version 0.3.0.\nThe exploitation method involves crafting specialized shell command payloads designed to conceal sensitive operations like git push or GitHub CLI (gh write) actions behind wrapper utilities or unparsed syntax structures.\nThe attack flow proceeds as follows: first, an authenticated user or a prompt-injected AI agent constructs a command string incorporating wrapper utilities (e.g., nice or timeout) or combined interpreter flags that obscure the true nature of the payload from the shell-command parser.\nSecond, the agent attempts to execute the command within the framework environment.\nThird, omnigent/policies/builtins/_shell.py processes the command string but fails to extract or recognize the underlying git push or gh write operations due to the parsing deficiency.\nFourth, because no explicit operation is recognized, the security policies implemented in github.py and working_dir.py abstain from enforcing restrictions, assuming the command is benign or out of scope.\nFifth, the operating system executes the command with the full privileges of the AI agent process, successfully bypassing repository allowlists and escaping the configured workspace directory boundaries.\nPost-exploitation impact includes unauthorized code injection into critical software repositories, unauthorized branch manipulation, and unauthorized file system access outside the designated working directory."
}