CVE-2026-62676: Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py writerepos and writebranches allowlist and the workingdir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
omnigentto a version that resolves this vulnerability.Fixed in 0.3.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Omnigent versions prior to 0.3.0 are affected where the github.py write_repos or write_branches allowlists, or the working_dir.py workspace confinement policy, are relied on to gate shell commands.
What does an attacker need to exploit this issue?
An attacker needs an authenticated or prompt-injected agent capable of issuing shell commands. They can hide a gated git push or gh write using unsupported command forms so the shared parser produces no operation and the affected policies allow the command.
Are policy restrictions sufficient protection before upgrading?
No. The affected allowlist and workspace-confinement policies can abstain and allow commands when interpreter flags, specified wrappers, command substitutions, or a single background control operator prevent parsing.
What should be done if patching is not immediately possible?
The provided information does not identify a complete workaround. Reduce exposure by not relying on the affected policies alone to authorize repository writes, branch writes, or workspace confinement until upgrading to 0.3.0.
How can teams determine whether they may already be affected?
Review whether agents on versions prior to 0.3.0 issued shell commands involving combined interpreter flags; timeout, nice, setsid, or stdbuf wrappers; command substitutions; or a single background control operator. Pay particular attention to git push and gh write activity targeting repositories or branches outside intended allowlists, and commands operating outside the intended workspace.