{
  "affected": [
    {
      "affectedData": [
        {
          "product": "omnigent",
          "vendor": "omnigent-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0."
    },
    {
      "lang": "es",
      "value": "Omnigent es un framework de agente de IA de c\u00f3digo abierto y un meta-arn\u00e9s para orquestar agentes de codificaci\u00f3n. Antes de la versi\u00f3n 0.3.0, un usuario autenticado puede cargar un paquete de agente con \u00e1mbito de sesi\u00f3n con un valor os_env.cwd absoluto o que contiene una ruta de acceso transversal porque omnigent/spec/parser.py almacena el valor textualmente y omnigent/spec/validator.py no lo restringe. En un ejecutor donde OMNIGENT_RUNNER_WORKSPACE no est\u00e1 configurado, omnigent/runner/resource_registry.py preserva la ruta controlada por el atacante y omnigent/inner/os_env.py utiliza la ruta resuelta como la ra\u00edz del entorno y la fuente de copytree. La verificaci\u00f3n _assert_within_cwd luego trata esa ra\u00edz seleccionada por el atacante como confiable, permitiendo que las herramientas sys_os_read, write, edit y shell accedan a los archivos del ejecutor y a los secretos del entorno fuera del espacio de trabajo previsto. Este problema se corrige en la versi\u00f3n 0.3.0."
    }
  ],
  "id": "CVE-2026-62677",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62677",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T21:00:11.438418Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T18:16:49.887",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/commit/7ca0cca3c9a65c04c489edf68f0e080424a26868"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/pull/1417"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-p8rw-8qj3-hf33"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "omnigent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T22:00:54Z",
    "nvd_published_at": "2026-08-21T18:16:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/\u003cvictim\u003e`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.\n\nThis is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -\u003e stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user\u0027s **own** session-scoped agent and is **not** addressed by that advisory\u0027s proposed shared-agent guard.\n\n### Preconditions\n\n- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized \u2014 so this is deployment-gated, not universal.\n- Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.\n\n### Details (verified against code)\n\n1. **Parse \u2014 no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `\"none\"` is legal.\n2. **Validate \u2014 cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egress combinations; it never references `cwd` (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in `server/schemas.py` validates a *caller-supplied workspace against* the spec cwd (treating the author cwd as trusted) and only for host-launched sessions \u2014 it does not bound the cwd.\n3. **Sink.** `omnigent/inner/os_env.py:890` sets `cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False)` as the environment root; `os_env.py:934` does `shutil.copytree(src=cwd, ...)` when `fork=true`. All agent file/shell tools are bounded by `_assert_within_cwd` (`os_env.py:1040`), which checks `resolved.relative_to(cwd)` \u2014 but since **cwd is attacker-controlled**, `cwd=/` makes the entire host filesystem in-bounds for read and write; `fork=true` with `cwd=/home/victim` copies that tree into the agent-readable workspace.\n4. **Decisive gate.** `omnigent/runner/resource_registry.py:648-654`: `cwd = default_cwd` only when `self._runner_workspace is not None or spec_os_env.cwd in (None, \".\", \"./\")`; otherwise `cwd = spec_os_env.cwd` (the attacker\u0027s absolute path). So `OMNIGENT_RUNNER_WORKSPACE` is the only thing standing between the spec and the host FS \u2014 and it is an operational control, not an in-code guard. A code comment at `tool_dispatch.py:~4207` claims cwd \"is treated as a boundary at session-create time,\" which is not true on this path.\n\n### Attack path\n\n1. Authenticated user sends `POST /v1/sessions` (multipart) with an agent bundle whose `config.yaml` contains:\n   ```yaml\n   os_env:\n     cwd: \"/\"            # or /home/\u003cvictim\u003e, with fork: true for one-shot exfil\n     sandbox: { type: none }\n   ```\n2. On a runner without `OMNIGENT_RUNNER_WORKSPACE`, the agent\u0027s `sys_os_read`/`write`/`edit`/`shell` tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner\u0027s full environment \u2014 exposing host secrets via e.g. `sys_os_shell(\"env\")`.\n\n### Impact\n\nArbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).\n\n### Suggested fix\n\nAdd a control on the `cwd` field itself in `omnigent/spec/_validate_os_env` (and/or at parse): reject absolute paths and `..` traversal, and require `cwd` to resolve within the runner workspace / an allow-listed root. Do not rely on `OMNIGENT_RUNNER_WORKSPACE` being set as the sole defense. Consider also disallowing bundle-author `sandbox.type: none` for server-realized (non-CLI) sessions.\n\n### Related\n\nGHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).",
  "id": "GHSA-p8rw-8qj3-hf33",
  "modified": "2026-09-02T22:00:54Z",
  "published": "2026-09-02T22:00:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-p8rw-8qj3-hf33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62677"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/pull/1417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/commit/7ca0cca3c9a65c04c489edf68f0e080424a26868"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/omnigent-ai/omnigent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "omnigent",
        "purl": "pkg:pypi/omnigent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1rc1",
        "0.0.1rc2",
        "0.1.0",
        "0.1.0rc1",
        "0.1.0rc2",
        "0.1.0rc3",
        "0.1.0rc4",
        "0.1.1",
        "0.1.1rc2",
        "0.2.0",
        "0.2.0rc1",
        "0.3.0rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62677",
    "GHSA-p8rw-8qj3-hf33"
  ],
  "details": "### Summary\n\nAn authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/\u003cvictim\u003e`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.\n\nThis is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -\u003e stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user\u0027s **own** session-scoped agent and is **not** addressed by that advisory\u0027s proposed shared-agent guard.\n\n### Preconditions\n\n- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized \u2014 so this is deployment-gated, not universal.\n- Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.\n\n### Details (verified against code)\n\n1. **Parse \u2014 no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `\"none\"` is legal.\n2. **Validate \u2014 cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egress combinations; it never references `cwd` (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in `server/schemas.py` validates a *caller-supplied workspace against* the spec cwd (treating the author cwd as trusted) and only for host-launched sessions \u2014 it does not bound the cwd.\n3. **Sink.** `omnigent/inner/os_env.py:890` sets `cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False)` as the environment root; `os_env.py:934` does `shutil.copytree(src=cwd, ...)` when `fork=true`. All agent file/shell tools are bounded by `_assert_within_cwd` (`os_env.py:1040`), which checks `resolved.relative_to(cwd)` \u2014 but since **cwd is attacker-controlled**, `cwd=/` makes the entire host filesystem in-bounds for read and write; `fork=true` with `cwd=/home/victim` copies that tree into the agent-readable workspace.\n4. **Decisive gate.** `omnigent/runner/resource_registry.py:648-654`: `cwd = default_cwd` only when `self._runner_workspace is not None or spec_os_env.cwd in (None, \".\", \"./\")`; otherwise `cwd = spec_os_env.cwd` (the attacker\u0027s absolute path). So `OMNIGENT_RUNNER_WORKSPACE` is the only thing standing between the spec and the host FS \u2014 and it is an operational control, not an in-code guard. A code comment at `tool_dispatch.py:~4207` claims cwd \"is treated as a boundary at session-create time,\" which is not true on this path.\n\n### Attack path\n\n1. Authenticated user sends `POST /v1/sessions` (multipart) with an agent bundle whose `config.yaml` contains:\n   ```yaml\n   os_env:\n     cwd: \"/\"            # or /home/\u003cvictim\u003e, with fork: true for one-shot exfil\n     sandbox: { type: none }\n   ```\n2. On a runner without `OMNIGENT_RUNNER_WORKSPACE`, the agent\u0027s `sys_os_read`/`write`/`edit`/`shell` tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner\u0027s full environment \u2014 exposing host secrets via e.g. `sys_os_shell(\"env\")`.\n\n### Impact\n\nArbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).\n\n### Suggested fix\n\nAdd a control on the `cwd` field itself in `omnigent/spec/_validate_os_env` (and/or at parse): reject absolute paths and `..` traversal, and require `cwd` to resolve within the runner workspace / an allow-listed root. Do not rely on `OMNIGENT_RUNNER_WORKSPACE` being set as the sole defense. Consider also disallowing bundle-author `sandbox.type: none` for server-realized (non-CLI) sessions.\n\n### Related\n\nGHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).",
  "id": "PYSEC-2026-3875",
  "modified": "2026-09-10T11:02:18.308444Z",
  "published": "2026-09-10T09:44:59.689355Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-p8rw-8qj3-hf33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62677"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/pull/1417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/commit/7ca0cca3c9a65c04c489edf68f0e080424a26868"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/omnigent-ai/omnigent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/omnigent"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p8rw-8qj3-hf33"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE"
}