{
  "affected": [
    {
      "affectedData": [
        {
          "product": "omnigent",
          "vendor": "omnigent-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user\u0027s agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0."
    },
    {
      "lang": "es",
      "value": "Omnigent es un framework de agente de IA de c\u00f3digo abierto y un meta-arn\u00e9s para orquestar agentes de codificaci\u00f3n. Antes de la versi\u00f3n 0.3.0, POST multipart /v1/sessions acepta un paquete de agente de un usuario autenticado y omnigent/servidor/bundles.py validate_agent_bundle no rechaza una ruta Python punteada tools..callable. omnigent/runner/tool_dispatch.py _resolve_spec_callable importa el m\u00f3dulo especificado y _execute_spec_callable_tool invoca la funci\u00f3n resuelta, permitiendo que un paquete seleccione subprocess.check_output y ejecute un comando local con los permisos del proceso del ejecutor. Esto puede exponer archivos del ejecutor, variables de entorno, credenciales, datos del espacio de trabajo, servicios internos y disponibilidad sin acceso de administrador. Este problema est\u00e1 solucionado en la versi\u00f3n 0.3.0."
    }
  ],
  "id": "CVE-2026-62675",
  "lastModified": "2026-10-14T21:10:00.183",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62675",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T18:11:11.340625Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T18:16:49.603",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/pull/1430"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "omnigent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62675"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T21:54:52Z",
    "nvd_published_at": "2026-08-21T18:16:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs.\n\nWhen the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at `subprocess.check_output`, which lets the attacker run a local command on the runner machine.\n\nThis is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.\n\n### Details\n\nThe uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart `POST /v1/sessions`; the Web UI uses this same endpoint for custom agents:\n\n[`Create custom agent` builds and uploads a bundle](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/shell/NewChatDialog.tsx#L1265-L1277) \n\\\n[`createBundledSession` posts the bundle to `/v1/sessions`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/lib/sessionsApi.ts#L421-L460)\n\nA crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.\n\nOn the server, uploaded bundles are validated here:\n[`validate_agent_bundle`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/server/bundles.py#L13-L75)\n\nThe validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:\n```python\nspec = load(\n    bundle_bytes,\n    dest=Path(tmpdir) / \"agent\",\n    expand_env=False,\n    enforce_handler_allowlist=enforce_handler_allowlist,\n)\n```\nHowever, the same validation does not reject `tools.\u003cname\u003e.callable` entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.\n\nThe docs describe server-side Python callable tools here: [`Python function tool` docs](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/docs/AGENT_YAML_SPEC.md#L229-L246)\n\\\nLater, the runner resolves and executes those callables: [`_resolve_spec_callable` imports the dotted path](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L444-L481)\n```python\nmod = importlib.import_module(module_name)\nfn = getattr(mod, attr_name, None)\n```\n[`_execute_spec_callable_tool` calls the resolved function](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L484-L511)\n```python\nresult = await asyncio.to_thread(resolved, **args)\n```\nThe high-level tool dispatcher falls back to this callable execution path: [`execute_tool` callable fallback](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L3958-L3965)\n```python\noutput = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)\n```\n\nThe problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.\n\nSuggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject `callable:` tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.\n\n### Impact\n\nThis is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.\n\nBecause the callable runs inside the runner process, the attacker-controlled code runs with the runner\u0027s permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.\n\nThis is high impact because it crosses the boundary from \"upload an agent config\" to \"execute local code on shared runner infrastructure\" without requiring admin/operator access.",
  "id": "GHSA-756x-9hf6-q4h4",
  "modified": "2026-09-02T21:54:52Z",
  "published": "2026-09-02T21:54:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62675"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/pull/1430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/omnigent-ai/omnigent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "omnigent",
        "purl": "pkg:pypi/omnigent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1rc1",
        "0.0.1rc2",
        "0.1.0",
        "0.1.0rc1",
        "0.1.0rc2",
        "0.1.0rc3",
        "0.1.0rc4",
        "0.1.1",
        "0.1.1rc2",
        "0.2.0",
        "0.2.0rc1",
        "0.3.0rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62675",
    "GHSA-756x-9hf6-q4h4"
  ],
  "details": "### Summary\n\nAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs.\n\nWhen the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at `subprocess.check_output`, which lets the attacker run a local command on the runner machine.\n\nThis is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.\n\n### Details\n\nThe uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart `POST /v1/sessions`; the Web UI uses this same endpoint for custom agents:\n\n[`Create custom agent` builds and uploads a bundle](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/shell/NewChatDialog.tsx#L1265-L1277) \n\\\n[`createBundledSession` posts the bundle to `/v1/sessions`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/lib/sessionsApi.ts#L421-L460)\n\nA crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.\n\nOn the server, uploaded bundles are validated here:\n[`validate_agent_bundle`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/server/bundles.py#L13-L75)\n\nThe validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:\n```python\nspec = load(\n    bundle_bytes,\n    dest=Path(tmpdir) / \"agent\",\n    expand_env=False,\n    enforce_handler_allowlist=enforce_handler_allowlist,\n)\n```\nHowever, the same validation does not reject `tools.\u003cname\u003e.callable` entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.\n\nThe docs describe server-side Python callable tools here: [`Python function tool` docs](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/docs/AGENT_YAML_SPEC.md#L229-L246)\n\\\nLater, the runner resolves and executes those callables: [`_resolve_spec_callable` imports the dotted path](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L444-L481)\n```python\nmod = importlib.import_module(module_name)\nfn = getattr(mod, attr_name, None)\n```\n[`_execute_spec_callable_tool` calls the resolved function](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L484-L511)\n```python\nresult = await asyncio.to_thread(resolved, **args)\n```\nThe high-level tool dispatcher falls back to this callable execution path: [`execute_tool` callable fallback](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L3958-L3965)\n```python\noutput = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)\n```\n\nThe problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.\n\nSuggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject `callable:` tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.\n\n### Impact\n\nThis is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.\n\nBecause the callable runs inside the runner process, the attacker-controlled code runs with the runner\u0027s permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.\n\nThis is high impact because it crosses the boundary from \"upload an agent config\" to \"execute local code on shared runner infrastructure\" without requiring admin/operator access.",
  "id": "PYSEC-2026-3872",
  "modified": "2026-09-10T11:02:18.106525Z",
  "published": "2026-09-10T09:44:59.594624Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62675"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/pull/1430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/omnigent-ai/omnigent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/omnigent"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-756x-9hf6-q4h4"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools"
}