Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path. omnigent/runner/tooldispatch.py resolvespeccallable imports the specified module and executespeccallabletool invokes the resolved function, allowing a bundle to select subprocess.checkoutput and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENTRUNNERWORKSPACE is unset, omnigent/runner/resourceregistry.py preserves the attacker-controlled path and omnigent/inner/osenv.py uses the resolved path as the environment root and copytree source. The assertwithincwd check then treats that attacker-selected root as trusted, allowing sysosread, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.