CVE-2026-62677: Omnigent AI Framework Path Traversal Flaw

CVE-2026-62677 Overview

CVE-2026-62677 is a path traversal vulnerability [CWE-22] in Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents. An authenticated user can upload a session-scoped agent bundle containing an absolute or traversal-laden os_env.cwd value. The framework stores the value verbatim and fails to constrain it during validation. When the runner lacks the OMNIGENT_RUNNER_WORKSPACE environment variable, the attacker-controlled path becomes the environment root. This allows sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. The issue is fixed in version 0.3.0.

Critical Impact
An authenticated attacker can escape the agent workspace sandbox and read, write, or execute against arbitrary host filesystem paths, exposing runner secrets and enabling lateral movement.

Affected Products

Omnigent AI agent framework versions prior to 0.3.0
Omnigent runners with OMNIGENT_RUNNER_WORKSPACE unset
Deployments accepting untrusted agent bundle uploads

Discovery Timeline

2026-08-21 - CVE-2026-62677 published to NVD
2026-08-21 - Last updated in NVD database
v0.3.0 - Omnigent releases patched version addressing GHSA-p8rw-8qj3-hf33

Technical Details for CVE-2026-62677

Vulnerability Analysis

The vulnerability resides in how Omnigent parses and validates the os_env.cwd field of an uploaded agent bundle specification. The parser at omnigent/spec/parser.py stores the supplied value verbatim without normalization. The validator at omnigent/spec/validator.py does not enforce that the path is relative or confined to a workspace.

When the runner starts without OMNIGENT_RUNNER_WORKSPACE set, omnigent/runner/resource_registry.py preserves the attacker-supplied path. The module omnigent/inner/os_env.py then treats the resolved path as the environment root and uses it as a copytree source. The internal _assert_within_cwd guard subsequently treats the attacker-chosen root as trusted, defeating its own containment purpose.

Root Cause

The root cause is missing input validation on a filesystem path field controlled by an authenticated user. The trust boundary is inverted: _assert_within_cwd validates that operations remain within a cwd that the attacker defined. Combined with the absent workspace override, this collapses the sandbox model for all agent tools that touch the filesystem or shell.

Attack Vector

An authenticated user uploads a crafted agent bundle whose os_env.cwd is either an absolute path (for example /etc or /root) or a traversal string (for example ../../). Once the session runs on a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read, write, edit, and shell tools operate against that path. The attacker can exfiltrate environment secrets, tamper with runner configuration, or execute shell commands against host files.

python

# Patch: reject absolute or traversal-containing os_env.cwd values
import hashlib
import tempfile
from pathlib import Path, PurePosixPath, PureWindowsPath

from omnigent.errors import ErrorCode, OmnigentError
from omnigent.spec import AgentSpec, ExtractionError, load


def _cwd_escapes_workspace(spec_cwd: str) -> bool:
    """Whether an agent-spec ``os_env.cwd`` would escape the session workspace.

    ``True`` for an absolute path or one containing a ``..`` segment, in
    either POSIX or Windows form (the runner is POSIX, but checking both
    avoids a separator-style bypass). Such a cwd must be rejected for
    untrusted uploads (GHSA-p8rw-8qj3-hf33): on a runner without
    ``OMNIGENT_RUNNER_WORKSPACE`` it becomes the agent environment root and
    ``copytree`` source, exposing the host filesystem.
    """
    posix, win = PurePosixPath(spec_cwd), PureWindowsPath(spec_cwd)
    return posix.is_absolute() or win.is_absolute() or ".." in posix.parts or ".." in win.parts

Source: GitHub Commit 7ca0cca

Detection Methods for CVE-2026-62677

Indicators of Compromise

Uploaded agent bundles containing os_env.cwd values that are absolute paths or include .. segments.
Runner filesystem access events targeting paths outside the expected session workspace, such as /etc, /root, or CI secret mount points.
copytree operations sourced from directories unrelated to the agent session workspace.
Shell tool invocations reading environment files, SSH keys, or cloud credential caches from the host.

Detection Strategies

Inspect stored agent bundle specifications and flag any os_env.cwd value failing the _cwd_escapes_workspace check.
Correlate agent tool telemetry (sys_os_read, write, edit, shell) with the declared session workspace path and alert on divergence.
Monitor runner processes for OMNIGENT_RUNNER_WORKSPACE being unset in production environments accepting external bundles.

Monitoring Recommendations

Enable audit logging on the bundle upload endpoint and archive submitted specs for retrospective review.
Alert on runner reads of sensitive files such as /etc/shadow, ~/.aws/credentials, or /proc/self/environ.
Track outbound network activity from runner hosts following bundle uploads to detect secret exfiltration.

How to Mitigate CVE-2026-62677

Immediate Actions Required

Upgrade Omnigent to version 0.3.0 or later on all runners and orchestration servers.
Set OMNIGENT_RUNNER_WORKSPACE explicitly on every runner to enforce a bounded workspace root.
Audit previously uploaded agent bundles for absolute or ..-containing os_env.cwd values and revoke suspect sessions.
Rotate any credentials, tokens, or secrets accessible from runner host environments.

Patch Information

The fix is available in Omnigent 0.3.0. See the GitHub Release v0.3.0, the merged Pull Request #1417, and the GitHub Security Advisory GHSA-p8rw-8qj3-hf33. The patch introduces _cwd_escapes_workspace in omnigent/server/bundles.py to reject absolute paths and paths containing .. segments during bundle validation.

Workarounds

Restrict bundle upload permissions to trusted operators until the patch is deployed.
Run runners inside ephemeral containers with read-only host mounts to limit blast radius from workspace escape.
Pre-validate submitted specs at the ingress layer, rejecting any os_env.cwd that is absolute or contains ...

bash

# Enforce a bounded workspace root on every Omnigent runner
export OMNIGENT_RUNNER_WORKSPACE=/var/lib/omnigent/workspaces
mkdir -p "$OMNIGENT_RUNNER_WORKSPACE"
chmod 750 "$OMNIGENT_RUNNER_WORKSPACE"

# Verify installed Omnigent version is patched
pip show omnigent | grep -i version
pip install --upgrade 'omnigent>=0.3.0'