OmniAgent, starting from commit 12b98c5, includes an approval bypass flaw in the ReflexionAgent._is_safe_bash_command method. The check mistakenly accepts any command that begins with the word "find" as safe, without evaluating the accompanying -execdir arguments. An attacker who can inject commands into a prompt can therefore execute find with -execdir to invoke binaries such as dd, nc, perl, or openssl through an unsandboxed shell, enabling arbitrary code execution or file overwrites without human approval.

The vulnerability affects the OmniAgent product supplied by YeQing17-2026. The affected codebase includes the commit 12b98c5, but no specific product version range is provided; any release containing this commit or earlier iterations of the ReflexionAgent module is potentially vulnerable.

The CVSS base score of 7.7 indicates a high severity, but EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred from the description: an attacker must gain the ability to inject commands into the agent’s prompt context and rely on the unsafe handling of find -execdir. If successful, the attacker can run arbitrary binaries, modify files, or execute code with the agent’s privileges. The lack of a sandbox around these commands magnifies the risk, making the flaw a strong candidate for exploitation in environments where OmniAgent has elevated permissions.