high · 8.8CVE-2026-62677Sep 2, 2026

CVE-2026-62677: Omnigent Path Traversal via Unvalidated os_env.cwd in Agent Bundle

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any authenticated Omnigent user can upload an agent bundle that sets its working directory to an arbitrary host path, giving the agent read and write access to the entire runner filesystem and…

Packageomnigent
Ecosystempip
Affected< 0.3.0
Fixed in0.3.0
CVE-2026-62677: Omnigent Path Traversal via Unvalidated os_env.cwd in Agent Bundle

The problem

Omnigent's bundle pipeline accepts the os_env.cwd field verbatim. spec/parser.py stores it as a plain string with no normalization, and spec/validator.py's _validate_os_env never checks or bounds the value.

At runtime, inner/os_env.py resolves whatever cwd the bundle declares and uses it as the root for all agent file and shell tools. Because _assert_within_cwd checks paths relative to that attacker-supplied root, setting cwd: / places the entire host filesystem in-bounds.

The only server-side guard is the OMNIGENT_RUNNER_WORKSPACE environment variable, which overrides the spec cwd when present. Deployments that omit it (many server-realized sessions do) are fully exposed.

Proof of concept

A working proof-of-concept for CVE-2026-62677 in omnigent, with the exact payload below.

bash
# config.yaml inside the uploaded agent bundle
os_env:
  cwd: "/"          # or /home/<victim> with fork: true for one-shot exfil
  sandbox:
    type: none

---
# Trigger: POST /v1/sessions (multipart, bundle containing the above config.yaml)
# After session creation, call any file/shell tool, e.g.:
# sys_os_shell("env")   <- dumps all runner environment variables
# sys_os_read("/etc/shadow") <- arbitrary host file read

The decisive gate is in runner/resource_registry.py:648-654: cwd is replaced with the safe default only when self._runner_workspace is not None or when the spec cwd is None, ., or ./. Any other value, including absolute paths like /, is passed through unmodified.

With cwd=/ resolved as the session root, _assert_within_cwd's resolved.relative_to(cwd) check always passes because every path on the filesystem is relative to /. Adding fork: true causes shutil.copytree(src=cwd, ...) to copy the targeted directory tree into the agent workspace in one shot, enabling bulk exfiltration.

CWE-22 (Path Traversal).

The fix

Upgrade to omnigent 0.3.0 (commit 7ca0cca3c9a65c04c489edf68f0e080424a26868, PR #1417). The patch adds a validation step in _validate_os_env (and at parse time) that rejects absolute paths and .. components in the cwd field, and requires the resolved path to stay within the runner workspace.

It also disallows sandbox.type: none for server-realized sessions. Do not rely on OMNIGENT_RUNNER_WORKSPACE alone as a defense.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research