CVE-2026-62677: Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENTRUNNERWORKSPACE is unset, omnigent/runner/resourceregistry.py preserves the attacker-controlled path and omnigent/inner/osenv.py uses the resolved path as the environment root and copytree source. The assertwithincwd check then treats that attacker-selected root as trusted, allowing sysosread, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
omnigentto a version that resolves this vulnerability.Fixed in 0.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Omnigent versions before 0.3.0 are exposed when a runner has OMNIGENT_RUNNER_WORKSPACE unset. The vulnerable path handling applies to session-scoped agent bundles supplied by authenticated users.
What does an attacker need to exploit the vulnerability?
An attacker needs authenticated access and the ability to upload a session-scoped agent bundle. They can provide an absolute or traversal-containing os_env.cwd value; no user interaction is required.
What access could exploitation provide?
The attacker-selected path can become the trusted environment root, allowing the agent's read, write, edit, and shell tools to operate on runner filesystem locations outside the intended workspace. This can expose environment secrets and permit modification of host files.
How can I determine whether a runner is at risk?
Check whether the deployment runs a version earlier than 0.3.0 and whether OMNIGENT_RUNNER_WORKSPACE is unset on its runners. Also review whether authenticated users can upload session-scoped agent bundles containing os_env.cwd values.
What should be done if upgrading is not immediately possible?
Set OMNIGENT_RUNNER_WORKSPACE on affected runners to avoid the condition in which the attacker-controlled path is preserved. Restrict upload access for session-scoped agent bundles until the deployment can be updated to 0.3.0.