CVE-2026-62677

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0

Description An authenticated user can upload a session-scoped agent bundle containing an absolute or traversal-containing os env.cwd value. This occurs because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py fails to constrain it. On runners where OMNIGENT RUNNER WORKSPACE is unset, omnigent/runner/resource registry.py preserves the attacker-controlled path, and omnigent/inner/os env.py uses this resolved path as the environment root and copytree source. Consequently, the assert within cwd() check treats the attacker-selected root as trusted, enabling sys os read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace.

Recommendations Update to version 0.3.0.