https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:28:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-62675 <p><strong>Affected:</strong> omnigent-ai omnigent</p> <p>Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user&#39;s agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.</p> <p><strong>Affected:</strong> omnigent-ai omnigent</p> <p>Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user&#39;s agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-62675 https://vulnerability.circl.lu/vuln/ghsa-756x-9hf6-q4h4 <p><strong>Affected:</strong> PyPI: omnigent</p> <p>### Summary</p> <p>An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs.</p> <p>When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at `subprocess.check_output`, which lets the attacker run a local command on the runner machine.</p> <p>This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.</p> <p>### Details</p> <p>The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart `POST /v1/sessions`; the Web UI uses this same endpoint for custom agents:</p> <p>[`Create custom agent` builds and uploads a bundle](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/shell/NewChatDialog.tsx#L1265-L1277) \ [`createBundledSession` posts the bundle to `/v1/sessions`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/lib/sessionsApi.ts#L421-L460)</p> <p>A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.</p> <p>On the server, uploaded bun…</p> <p><strong>Affected:</strong> PyPI: omnigent</p> <p>### Summary</p> <p>An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs.</p> <p>When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at `subprocess.check_output`, which lets the attacker run a local command on the runner machine.</p> <p>This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.</p> <p>### Details</p> <p>The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart `POST /v1/sessions`; the Web UI uses this same endpoint for custom agents:</p> <p>[`Create custom agent` builds and uploads a bundle](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/shell/NewChatDialog.tsx#L1265-L1277) \ [`createBundledSession` posts the bundle to `/v1/sessions`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/lib/sessionsApi.ts#L421-L460)</p> <p>A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.</p> <p>On the server, uploaded bun…</p> https://vulnerability.circl.lu/vuln/ghsa-756x-9hf6-q4h4