CVE-2026-62677: Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Summary
An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.
This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.
Preconditions
- Runner realizes a session-scoped uploaded bundle without OMNIGENTRUNNERWORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal. - Attacker is any authenticated user (no admin scope; requireuser only checks identity). No shared-agent overwrite needed.
Details (verified against code)
1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwdraw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal. 2. Validate — cwd unconstrained. omnigent/spec/validator.py validateosenv checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd. 3. Sink. omnigent/inner/osenv.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; osenv.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by assertwithincwd (osenv.py:1040), which checks resolved.relativeto(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace. 4. Decisive gate. omnigent/runner/resourceregistry.py:648-654: cwd = defaultcwd only when self.runnerworkspace is not None or specosenv.cwd in (None, ".", "./"); otherwise cwd = specosenv.cwd (the attacker's absolute path). So OMNIGENTRUNNERWORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tooldispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.
Attack path
1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains: yaml osenv: cwd: "/" # or /home/<victim>, with fork: true for one-shot exfil sandbox: { type: none } 2. On a runner without OMNIGENTRUNNERWORKSPACE, the agent's sysosread/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sysosshell("env").
Impact
Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).
Suggested fix
Add a control on the cwd field itself in omnigent/spec/validateosenv (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENTRUNNERWORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.
Related
GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).
Other sources
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENTRUNNERWORKSPACE is unset, omnigent/runner/resourceregistry.py preserves the attacker-controlled path and omnigent/inner/osenv.py uses the resolved path as the environment root and copytree source. The assertwithincwd check then treats that attacker-selected root as trusted, allowing sysosread, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/omnigentto a version that resolves this vulnerability.Fixed in 0.3.0 - Configuration
In omnigent/spec/_validate_os_env (and/or in omnigent/spec/parser.py), add a boundary check for os_env.cwd: reject absolute paths (e.g., starting with '/' or '//'), reject any '..' path traversal, and require that cwd resolves under the intended runner workspace or an explicit allow-listed root (do not treat attacker-provided cwd as trusted).
omnigent/spec/validator.py (_validate_os_env) os_env.cwd validation = Reject absolute paths and '..' traversal; require resolved cwd to be within runner workspace or an allow-listed root - Configuration
In omnigent/spec/parser.py, change the logic that sets cwd=str(cwd_raw) to perform the same validation/boundary enforcement (reject absolute paths and '..' traversal; ensure resolved path is within the allowed root) rather than storing the attacker-controlled value verbatim.
omnigent/spec/parser.py cwd=str(cwd_raw) = Validate/normalize before storing; do not store cwd verbatim - Configuration
Harden omnigent/inner/os_env.py where it computes cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) and uses it as the environment root and fork/copytree source: ensure the previously validated cwd is enforced, so fork=true cannot copytree from outside the allowed root.
omnigent/inner/os_env.py cwd source for environment root = Do not allow cwd outside workspace/allow-listed root - Configuration
If the session is server-realized (non-CLI), add policy to reject bundles with sandbox.type: none (the issue notes sandbox.type can be author-chosen and "none" is legal) so that host environment inheritance and unrestricted tool behavior is not permitted.
omnigent/spec validator/sandbox policy sandbox.type = Disallow sandbox.type: none for server-realized (non-CLI) sessions
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Omnigent versions before 0.3.0 are exposed when a runner has OMNIGENT_RUNNER_WORKSPACE unset. The vulnerable path handling applies to session-scoped agent bundles supplied by authenticated users.
What does an attacker need to exploit the vulnerability?
An attacker needs authenticated access and the ability to upload a session-scoped agent bundle. They can provide an absolute or traversal-containing os_env.cwd value; no user interaction is required.
What access could exploitation provide?
The attacker-selected path can become the trusted environment root, allowing the agent's read, write, edit, and shell tools to operate on runner filesystem locations outside the intended workspace. This can expose environment secrets and permit modification of host files.
How can I determine whether a runner is at risk?
Check whether the deployment runs a version earlier than 0.3.0 and whether OMNIGENT_RUNNER_WORKSPACE is unset on its runners. Also review whether authenticated users can upload session-scoped agent bundles containing os_env.cwd values.
What should be done if upgrading is not immediately possible?
Set OMNIGENT_RUNNER_WORKSPACE on affected runners to avoid the condition in which the attacker-controlled path is preserved. Restrict upload access for session-scoped agent bundles until the deployment can be updated to 0.3.0.