CVE-2026-62677 - Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Brief
CVE ID : CVE-2026-62677
Published : Aug. 21, 2026, 6:16 p. m.
- 53 minutes ago
Description : Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.
- 0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env. cwd value because omnigent/spec/parser. py stores the value verbatim and omnigent/spec/validator. py does not constrain it.
On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry. py preserves the attacker-controlled path and omnigent/inner/os_env. py uses the resolved path as the environment root and copytree source.
The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace.