Omnigent is an AI agent framework that allows users to upload agent bundles. Before version 0.3.0 an authenticated user can set the os_env.cwd field in the bundle to an absolute or path‑traversal string. Because the framework stores this value without validation, the runner resolves it as a filesystem root and copies files from that location, enabling the attacker to read, write, edit, or execute arbitrary files on the host, including environment secrets. The flaw is a classic path‑traversal weakness identified as CWE‑22.

The affected product is Omnigent, the AI agent framework provided by omnigent‑ai. All releases older than version 0.3.0 are vulnerable. No specific sub‑product is mentioned; the issue exists whenever the OMNIGENT_RUNNER_WORKSPACE environment variable is not set.

The CVSS score of 8.8 classifies the vulnerability as high severity. EPSS data is not available, but the lack of detection in the KEV catalog does not reduce the risk to an unprivileged host. An attacker only needs authenticated upload access and a runner configuration that leaves OMNIGENT_RUNNER_WORKSPACE unset. Once the malformed cwd is accepted, the attacker is effectively untrusted and can perform arbitrary reads and writes on the host file system, with possible exposure of sensitive secrets and potential lateral movement. Given the high score and the direct exploitation path, the risk of exploitation remains significant until a patch is applied.