{"id":"CVE-2026-62677","aliases":["EUVD-2026-64015","GHSA-p8rw-8qj3-hf33","PYSEC-2026-3875"],"status":"published","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00606,"percentile":0.49347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-21T17:44:37Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"PyPI","package":"omnigent","fixed_in":["0.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"omnigent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"omnigent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}],"versions":["0.0.1rc1","0.0.1rc2","0.1.0","0.1.0rc1","0.1.0rc2","0.1.0rc3","0.1.0rc4","0.1.1","0.1.1rc2","0.2.0","0.2.0rc1","0.3.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"omnigent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0"}]}],"versions":["0.0.1rc1","0.0.1rc2","0.1.0","0.1.0rc1","0.1.0rc2","0.1.0rc3","0.1.0rc4","0.1.1","0.1.1rc2","0.2.0","0.2.0rc1","0.3.0rc1"]}],"products":[{"vendor":"omnigent-ai","product":"omnigent"}],"references":[{"url":"https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-p8rw-8qj3-hf33","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/omnigent-ai/omnigent/pull/1417","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/omnigent-ai/omnigent/commit/7ca0cca3c9a65c04c489edf68f0e080424a26868","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62677","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p8rw-8qj3-hf33","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62677.json","tags":["advisory"]},{"url":"https://github.com/omnigent-ai/omnigent","tags":["package"]},{"url":"https://pypi.org/project/omnigent","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-62677","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T17:44:37.312Z","modified":"2026-08-21T21:43:48.824Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-64015","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T17:44:37Z","modified":"2026-08-21T21:43:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:36.844009Z"}],"ghsa":[{"id":"GHSA-p8rw-8qj3-hf33","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","description":"### Summary\n\nAn authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/\u003cvictim\u003e`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.\n\nThis is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -\u003e stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user's **own** session-scoped agent and is **not** addressed by that advisory's proposed shared-agent guard.\n\n### Preconditions\n\n- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized — so this is deployment-gated, not universal.\n- Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.\n\n### Details (verified against code)\n\n1. **Parse — no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `\"none\"` is legal.\n2. **Validate — cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egress combinations; it never references `cwd` (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in `server/schemas.py` validates a *caller-supplied workspace against* the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.\n3. **Sink.** `omnigent/inner/os_env.py:890` sets `cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False)` as the environment root; `os_env.py:934` does `shutil.copytree(src=cwd, ...)` when `fork=true`. All agent file/shell tools are bounded by `_assert_within_cwd` (`os_env.py:1040`), which checks `resolved.relative_to(cwd)` — but since **cwd is attacker-controlled**, `cwd=/` makes the entire host filesystem in-bounds for read and write; `fork=true` with `cwd=/home/victim` copies that tree into the agent-readable workspace.\n4. **Decisive gate.** `omnigent/runner/resource_registry.py:648-654`: `cwd = default_cwd` only when `self._runner_workspace is not None or spec_os_env.cwd in (None, \".\", \"./\")`; otherwise `cwd = spec_os_env.cwd` (the attacker's absolute path). So `OMNIGENT_RUNNER_WORKSPACE` is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at `tool_dispatch.py:~4207` claims cwd \"is treated as a boundary at session-create time,\" which is not true on this path.\n\n### Attack path\n\n1. Authenticated user sends `POST /v1/sessions` (multipart) with an agent bundle whose `config.yaml` contains:\n   ```yaml\n   os_env:\n     cwd: \"/\"            # or /home/\u003cvictim\u003e, with fork: true for one-shot exfil\n     sandbox: { type: none }\n   ```\n2. On a runner without `OMNIGENT_RUNNER_WORKSPACE`, the agent's `sys_os_read`/`write`/`edit`/`shell` tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. `sys_os_shell(\"env\")`.\n\n### Impact\n\nArbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).\n\n### Suggested fix\n\nAdd a control on the `cwd` field itself in `omnigent/spec/_validate_os_env` (and/or at parse): reject absolute paths and `..` traversal, and require `cwd` to resolve within the runner workspace / an allow-listed root. Do not rely on `OMNIGENT_RUNNER_WORKSPACE` being set as the sole defense. Consider also disallowing bundle-author `sandbox.type: none` for server-realized (non-CLI) sessions.\n\n### Related\n\nGHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).","status":"published","published":"2026-09-02T22:00:54Z","modified":"2026-09-02T22:00:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-62677","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T18:16:49.887Z","modified":"2026-10-14T19:10:00.297Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-62677","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.","status":"published","published":"2026-08-21T17:44:37.312Z","modified":"2026-10-28T02:31:10.295847804Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-p8rw-8qj3-hf33","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","description":"### Summary\n\nAn authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/\u003cvictim\u003e`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.\n\nThis is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -\u003e stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user's **own** session-scoped agent and is **not** addressed by that advisory's proposed shared-agent guard.\n\n### Preconditions\n\n- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized — so this is deployment-gated, not universal.\n- Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.\n\n### Details (verified against code)\n\n1. **Parse — no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `\"none\"` is legal.\n2. **Validate — cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egress combinations; it never references `cwd` (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in `server/schemas.py` validates a *caller-supplied workspace against* the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.\n3. **Sink.** `omnigent/inner/os_env.py:890` sets `cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False)` as the environment root; `os_env.py:934` does `shutil.copytree(src=cwd, ...)` when `fork=true`. All agent file/shell tools are bounded by `_assert_within_cwd` (`os_env.py:1040`), which checks `resolved.relative_to(cwd)` — but since **cwd is attacker-controlled**, `cwd=/` makes the entire host filesystem in-bounds for read and write; `fork=true` with `cwd=/home/victim` copies that tree into the agent-readable workspace.\n4. **Decisive gate.** `omnigent/runner/resource_registry.py:648-654`: `cwd = default_cwd` only when `self._runner_workspace is not None or spec_os_env.cwd in (None, \".\", \"./\")`; otherwise `cwd = spec_os_env.cwd` (the attacker's absolute path). So `OMNIGENT_RUNNER_WORKSPACE` is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at `tool_dispatch.py:~4207` claims cwd \"is treated as a boundary at session-create time,\" which is not true on this path.\n\n### Attack path\n\n1. Authenticated user sends `POST /v1/sessions` (multipart) with an agent bundle whose `config.yaml` contains:\n   ```yaml\n   os_env:\n     cwd: \"/\"            # or /home/\u003cvictim\u003e, with fork: true for one-shot exfil\n     sandbox: { type: none }\n   ```\n2. On a runner without `OMNIGENT_RUNNER_WORKSPACE`, the agent's `sys_os_read`/`write`/`edit`/`shell` tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. `sys_os_shell(\"env\")`.\n\n### Impact\n\nArbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).\n\n### Suggested fix\n\nAdd a control on the `cwd` field itself in `omnigent/spec/_validate_os_env` (and/or at parse): reject absolute paths and `..` traversal, and require `cwd` to resolve within the runner workspace / an allow-listed root. Do not rely on `OMNIGENT_RUNNER_WORKSPACE` being set as the sole defense. Consider also disallowing bundle-author `sandbox.type: none` for server-realized (non-CLI) sessions.\n\n### Related\n\nGHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).","status":"published","published":"2026-09-02T22:00:54Z","modified":"2026-09-10T12:25:35.012514928Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"PYSEC-2026-3875","title":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","description":"### Summary\n\nAn authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-secret disclosure) on an Omnigent **runner** by uploading an agent bundle whose `os_env.cwd` points outside any intended workspace (e.g. `/` or `/home/\u003cvictim\u003e`). The `cwd` field is taken **verbatim** from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.\n\nThis is a **different sink** from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -\u003e stdio MCP RCE). It shares the bundle-upload *vector* but is reached through the user's **own** session-scoped agent and is **not** addressed by that advisory's proposed shared-agent guard.\n\n### Preconditions\n\n- Runner realizes a session-scoped uploaded bundle **without** `OMNIGENT_RUNNER_WORKSPACE` set. When that env var is set (CLI- and host-launched sessions set it), the spec `cwd` is overridden and the attack is neutralized — so this is deployment-gated, not universal.\n- Attacker is any authenticated user (no admin scope; `_require_user` only checks identity). No shared-agent overwrite needed.\n\n### Details (verified against code)\n\n1. **Parse — no validation.** `omnigent/spec/parser.py:696` stores `cwd=str(cwd_raw)` verbatim. Absolute paths (`/`, `/etc`), `../..`, etc. are all accepted. The `sandbox.type` is likewise author-chosen and `\"none\"` is legal.\n2. **Validate — cwd unconstrained.** `omnigent/spec/validator.py` `_validate_os_env` checks only fork/scratch/egress combinations; it never references `cwd` (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in `server/schemas.py` validates a *caller-supplied workspace against* the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.\n3. **Sink.** `omnigent/inner/os_env.py:890` sets `cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False)` as the environment root; `os_env.py:934` does `shutil.copytree(src=cwd, ...)` when `fork=true`. All agent file/shell tools are bounded by `_assert_within_cwd` (`os_env.py:1040`), which checks `resolved.relative_to(cwd)` — but since **cwd is attacker-controlled**, `cwd=/` makes the entire host filesystem in-bounds for read and write; `fork=true` with `cwd=/home/victim` copies that tree into the agent-readable workspace.\n4. **Decisive gate.** `omnigent/runner/resource_registry.py:648-654`: `cwd = default_cwd` only when `self._runner_workspace is not None or spec_os_env.cwd in (None, \".\", \"./\")`; otherwise `cwd = spec_os_env.cwd` (the attacker's absolute path). So `OMNIGENT_RUNNER_WORKSPACE` is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at `tool_dispatch.py:~4207` claims cwd \"is treated as a boundary at session-create time,\" which is not true on this path.\n\n### Attack path\n\n1. Authenticated user sends `POST /v1/sessions` (multipart) with an agent bundle whose `config.yaml` contains:\n   ```yaml\n   os_env:\n     cwd: \"/\"            # or /home/\u003cvictim\u003e, with fork: true for one-shot exfil\n     sandbox: { type: none }\n   ```\n2. On a runner without `OMNIGENT_RUNNER_WORKSPACE`, the agent's `sys_os_read`/`write`/`edit`/`shell` tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. `sys_os_shell(\"env\")`.\n\n### Impact\n\nArbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).\n\n### Suggested fix\n\nAdd a control on the `cwd` field itself in `omnigent/spec/_validate_os_env` (and/or at parse): reject absolute paths and `..` traversal, and require `cwd` to resolve within the runner workspace / an allow-listed root. Do not rely on `OMNIGENT_RUNNER_WORKSPACE` being set as the sole defense. Consider also disallowing bundle-author `sandbox.type: none` for server-realized (non-CLI) sessions.\n\n### Related\n\nGHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).","status":"published","published":"2026-09-10T09:44:59.689355Z","modified":"2026-09-10T12:15:10.11529927Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}