CVE-2026-62677: Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.
This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user’s own session-scoped agent and is not addressed by that advisory’s proposed shared-agent guard.
References
- github.com/advisories/GHSA-p8rw-8qj3-hf33
- github.com/omnigent-ai/omnigent/commit/7ca0cca3c9a65c04c489edf68f0e080424a26868
- github.com/omnigent-ai/omnigent/pull/1417
- github.com/omnigent-ai/omnigent/releases/tag/v0.3.0
- github.com/omnigent-ai/omnigent/security/advisories/GHSA-p8rw-8qj3-hf33
- nvd.nist.gov/vuln/detail/CVE-2026-62677
Code Behaviors & Features
Detect and mitigate CVE-2026-62677 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →