CVE-2026-112015: Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting osenv.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can upload a bundle can exploit it by placing a nested sub-agent in the bundle and setting its os_env.cwd to an absolute path or a parent-traversing path.
What access could an attacker gain?
The attacker can escape the intended workspace and read or write host files with the permissions of the runner user. The impact includes confidentiality, integrity, and availability of files accessible to that account.
Which versions are affected?
Omnigent versions from 0.3.0 before 0.14.0 are affected. Upgrading to 0.14.0 or later addresses the affected version range.
What can be done if an upgrade is not immediately possible?
Restrict bundle-upload access to trusted users and prevent untrusted bundles from defining nested sub-agents with os_env.cwd values that are absolute or contain parent-directory traversal. Run the runner user with minimal filesystem permissions to limit the files reachable after workspace escape.