A flaw in Omnigent allows an authenticated user with edit permissions to overwrite a shared agent bundle, injecting a malicious command that is run by the Omnigent runner process. The vulnerability is a code injection issue (CWE‑94) and can let an attacker execute arbitrary commands, potentially exposing configuration files, credentials, workspace data, internal services, and disrupting runner availability.

The Omnigent framework, specifically the omnigent product, is affected. All releases before 0.3.0 contain the flaw. Users of earlier versions must upgrade to 0.3.0 or newer, which implements the missing permission check for shared and template agents.

The CVSS score of 9 indicates a high-severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with edit access to a session; the attacker can then replace the shared agent bundle via the PUT /sessions/{session_id}/agent endpoint, delete the security boundary that prevents code execution, and trigger a command that runs with the privileged runner process. If exploited, the attacker could gain full control over the system, exposing sensitive data and affecting service availability.