Description
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
omnigent-ai omnigent
Default version status: unaffected
0.3.0 to < 0.14.0affected
pkg:pypi/omnigentReferences
- https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-p5x3-3gqh-x44g ↗
- https://github.com/omnigent-ai/omnigent/blob/v0.13.0/omnigent/server/bundles.py#L138-L155 ↗
- https://github.com/omnigent-ai/omnigent/commit/4a406d5b3b3f3a7c3401eab659ab04e728923b94 ↗
- https://github.com/omnigent-ai/omnigent/releases/tag/v0.14.0 ↗
- https://www.vulncheck.com/advisories/omnigent-0.3.0-before-0.14.0-path-traversal-via-sub-agent-os-env-cwd ↗