CVE-2026-125368

Description

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/YeQing17-2026/OmniAgent/issues/67 ↗
• https://github.com/YeQing17-2026/OmniAgent ↗
• https://github.com/YeQing17-2026/OmniAgent/blob/12b98c520959eff88a6cfa3dd233497084360ab0/omniagent/agents/reflexion.py#L1379 ↗
• https://www.vulncheck.com/advisories/omniagent-bash-approval-gate-bypass-via-find-execdir-in-safe-command-allowlist ↗