Description
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.
Published: 2026-08-21
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The shell‑command parser fails to handle combined interpreter flags, timeouts, 'nice', 'setsid', 'stdbuf', command substitutions, and background operators, allowing an authenticated or prompt‑injected agent to bypass policies and perform unauthorized writes to Git repositories or escape the intended workspace confines. This is a CWE‑184 weakness.

Affected Systems

Omnigent AI's open-source Omnigent framework prior to version 0.3.0, specifically the shared shell‑command parser in policies/builtins/_shell.py that underpins the write_repos, write_branches and workspace confinement policies.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, but the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to be authenticated or to inject a prompt that allows construction of the blocked command forms; under those conditions the vulnerability can be exploited to gain unauthorized repository access and escape workspace confinement.

Generated by OpenCVE AI on August 21, 2026 at 19:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade from Omnigent 0.2.x or earlier to release 0.3.0 or any later version where the shell‑command parser has been fixed.
  • Restrict agent authentication so that only trusted agents can invoke Git write operations, and review existing permission scopes for repository and branch writes.
  • Implement monitoring of Git push activity originating from agents to detect unexpected repository or branch modifications, and set up alerts for failed or unusual command executions.

Generated by OpenCVE AI on August 21, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7mqg-cx4g-x2rf Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
History

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Omnigent-ai
Omnigent-ai omnigent
Vendors & Products Omnigent-ai
Omnigent-ai omnigent

Fri, 21 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.
Title Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Weaknesses CWE-184
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Omnigent-ai Omnigent
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T17:32:00.761Z

Reserved: 2026-07-14T20:22:04.395Z

Link: CVE-2026-62676

cve-icon Vulnrichment

Updated: 2026-08-26T17:31:56.422Z

cve-icon NVD

Status : Received

Published: 2026-08-21T18:16:49.743

Modified: 2026-08-26T18:16:55.910

Link: CVE-2026-62676

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:15:19Z

Weaknesses
  • CWE-184

    Incomplete List of Disallowed Inputs