Description

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T18:16:49.887Z",
  "pubdate": "2026-08-21T18:16:49.887Z",
  "executiveSummary": "An arbitrary file access vulnerability exists in Omnigent prior to version 0.3.0, allowing an authenticated user to traverse and access runner files and environment secrets outside the intended workspace.\nThe vulnerability arises due to insufficient validation of the os_env.cwd parameter within session-scoped agent bundles, which allows absolute or traversal-containing paths to be processed.\nAttackers with authenticated access can upload malicious agent bundles to exploit the flaw, leading to unauthorized read, write, edit, and shell tool execution against files outside the designated workspace boundaries.\nThis introduces severe risks to confidentiality and integrity on affected runners, particularly when the OMNIGENT_RUNNER_WORKSPACE environment variable is unset.\nRemediation requires upgrading Omnigent to version 0.3.0 or later, where proper path constraints and validation are enforced.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and path sanitization during the parsing and validation of session-scoped agent bundles in Omnigent prior to version 0.3.0.\nSpecifically, omnigent/spec/parser.py stores the os_env.cwd value verbatim from user uploads, while omnigent/spec/validator.py fails to enforce structural constraints or restrict the path against directory traversal or absolute paths.\nOn runner environments where OMNIGENT_RUNNER_WORKSPACE is left unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path without proper normalization or sanitization.\nSubsequently, omnigent/inner/os_env.py utilizes this resolved path as both the environment root and the copytree source directory.\nThe internal security check _assert_within_cwd erroneously treats the attacker-selected root as a trusted boundary, completely bypassing path restriction checks.\nAs an attack flow, an authenticated user creates and uploads a specially crafted session-scoped agent bundle containing an absolute path or directory traversal sequences (such as ../) within the os_env.cwd specification.\nUpon execution, the runner adopts the attacker-controlled path as the environment root.\nThis enables system tools including sys_os_read, write, edit, and shell execution capabilities to interact with arbitrary runner files and environment secrets located outside the intended workspace.\nThe affected components comprise omnigent/spec/parser.py, omnigent/spec/validator.py, omnigent/runner/resource_registry.py, and omnigent/inner/os_env.py across versions prior to 0.3.0.\nExploitation requires authentication to upload agent bundles, but does not necessitate specific external network exposure beyond the application interface handling bundle ingestion."
}