CVE-2026-62676
Received Received - Intake

Command Injection in Omnigent AI Agent Framework

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62676
EUVD
EUVD-2026-64014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omnigent-ai omnigent to 0.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Omnigent's AI agent framework involves a flawed shell-command parser that fails to detect disguised commands. Attackers can hide unauthorized commands like git push or gh write behind interpreter flags, wrappers, or substitutions. The parser returns no operation for these disguised commands, causing security policies to abstain and default to allowing the action. The issue was fixed in version 0.3.0 by improving the parser to recognize and parse hidden commands correctly.

Detection Guidance

To detect this vulnerability, inspect the omnigent framework version. If using a version prior to 0.3.0, the system is vulnerable. Check installed versions with commands like pip show omnigent or grep version in project files. Monitor for unauthorized git push or gh write commands bypassing security gates.

Impact Analysis

An authenticated or prompt-injected agent could bypass security gates to push to unauthorized repositories or branches. It could also escape intended workspace confinement, allowing unauthorized file system access. The impact includes potential data leaks, unauthorized code changes, or system compromise depending on the agent's permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's access controls. Compliance failures may result in legal penalties, data breach notifications, and reputational damage due to inadequate access controls and policy enforcement.

Mitigation Strategies

Upgrade to omnigent version 0.3.0 or later immediately. Review and update shell-command parser configurations to ensure hidden commands are properly parsed. Test policies to confirm disguised commands are now denied by default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart