Advisories for Pypi/Omnigent package

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine. This …

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline. This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It …

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.