CVE-2026-62675
Received Received - Intake

Command Injection in Omnigent AI Agent Framework

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62675
EUVD
EUVD-2026-64018

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omnigent-ai omnigent to 0.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Omnigent AI framework allows an authenticated user to upload a malicious agent bundle containing a Python callable tool with a dotted import path like subprocess.check_output. The runner executes this tool via importlib, enabling remote code execution (RCE) on the runner machine with the same permissions as the runner process.

Detection Guidance

Check for unauthorized agent bundles with dotted Python import paths in Omnigent's /v1/sessions endpoint. Monitor for unexpected subprocess calls or file access by runner processes. Review logs for tools..callable paths in uploaded configurations.

Impact Analysis

An attacker could execute arbitrary commands on the runner machine, potentially accessing sensitive data, environment variables, credentials, workspace files, or internal services. This could lead to data breaches, service disruption, or further network compromise depending on the runner's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade to Omnigent version 0.3.0 or later. Disable or restrict agent bundle uploads from untrusted sources. Implement allowlisting for server-side Python callable tools via enforce_handler_allowlist. Audit existing bundles for malicious callable paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart