https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:37:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-62677 <p><strong>Affected:</strong> omnigent-ai omnigent</p> <p>Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.</p> <p><strong>Affected:</strong> omnigent-ai omnigent</p> <p>Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-62677 https://vulnerability.circl.lu/vuln/ghsa-p8rw-8qj3-hf33 <p><strong>Affected:</strong> PyPI: omnigent</p> <p>### Summary</p> <p>An authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/&lt;victim&gt;`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.</p> <p>This is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -&gt; stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user&#39;s **own** session-scoped agent and is **not** addressed by that advisory&#39;s proposed shared-agent guard.</p> <p>### Preconditions</p> <p>- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized — so this is deployment-gated, not universal. - Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.</p> <p>### Details (verified against code)</p> <p>1. **Parse — no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `&#34;none&#34;` is legal. 2. **Validate — cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egr…</p> <p><strong>Affected:</strong> PyPI: omnigent</p> <p>### Summary</p> <p>An authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/&lt;victim&gt;`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.</p> <p>This is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -&gt; stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user&#39;s **own** session-scoped agent and is **not** addressed by that advisory&#39;s proposed shared-agent guard.</p> <p>### Preconditions</p> <p>- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized — so this is deployment-gated, not universal. - Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.</p> <p>### Details (verified against code)</p> <p>1. **Parse — no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `&#34;none&#34;` is legal. 2. **Validate — cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egr…</p> https://vulnerability.circl.lu/vuln/ghsa-p8rw-8qj3-hf33