This vulnerability allows an authenticated user to upload a custom agent bundle containing a dotted Python path for a callable tool. The framework accepts the bundle without validating the tools path, then imports and executes the specified function with the runner's privileges. An attacker can therefore run arbitrary code on the host, leaking files, environment variables, credentials, workspace data, and potentially impacting internal services or availability. The weakness is an uncontrolled remote code execution flaw (CWE-94).

The defect exists in the Omnigent open‑source AI agent framework provided by omnigent‑ai. Versions of the framework before 0.3.0 are affected; the issue is fixed in release 0.3.0. Users running any prior release must update to mitigate the risk.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so current market exploitation data is unknown, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable only by users possessing valid authentication to the service, but once authenticated the attacker can instruct the runner to execute arbitrary commands. Consequently, the attack vector is authenticated remote code execution. Prompt patching is advised given the high severity and the ease of exploitation once access is granted.