OmniRoute 3.8.49 and earlier allow attacker-controlled binary and versionCommand values to be passed to POST /api/acp/agents. Only a weak self-consistency check is performed before execFileSync invokes the system interpreter, enabling execution of arbitrary code. The same input path also triggers refreshAgentCache and resolveVersionProbe, which accept the command before the execFileSync sink runs it. The tokenization filter removes a limited set of shell metacharacters but still permits interpreter evaluation arguments. The authentication logic relies on isAuthRequired, which accepts anonymous requests when requireLogin is false and the endpoint is not listed as local-only or spawn-capable. Consequently, an unauthenticated attacker during a fresh-instance bootstrap or when requireLogin is false can supply an interpreter argument and execute code within the server container. If requireLogin is true, the attacker must obtain a management session or API key. No fix is released yet.

Vendors: diegosouzapw OmniRoute. Affected versions: 3.8.49 and all earlier releases. The vulnerability exists in the open-source AI gateway that exposes a single endpoint for multiple model providers.

The CVSS score of 9.5 classifies this as critical. EPSS is not available, so the probability cannot be quantified, but the lack of a fix and the ability to execute code with container privileges make it high risk. The vulnerability is not listed in CISA KEV. Exploitation requires either unauthenticated access with requireLogin=false or, if authentication is enforced, the attacker must acquire a management credential or key. In either scenario, gained code execution can compromise the entire server container, potentially giving full control over the host.