CVE-2026-125368: OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist
OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent.issafebashcommand that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using OmniAgent code through commit 12b98c5 are exposed where the ReflexionAgent safe-command allowlist is relied on to require human approval for Bash commands. An attacker does not need prior privileges, but must be able to prompt-inject an agent into issuing the crafted command.
What does successful exploitation require?
The attacker needs user interaction, as reflected by the UI:R vector, and must induce the agent to run a command beginning with find. They can use find -execdir arguments to invoke binaries such as dd, nc, perl, or openssl through an unsandboxed shell without human approval.
What is the impact if the approval gate is bypassed?
The bypass can allow overwriting files or executing code without human approval. The reported CVSS vector indicates high impact to confidentiality, integrity, and availability.