CVE-2026-62675: Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.
When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.
This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.
References
- github.com/advisories/GHSA-756x-9hf6-q4h4
- github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0
- github.com/omnigent-ai/omnigent/pull/1430
- github.com/omnigent-ai/omnigent/releases/tag/v0.3.0
- github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4
- nvd.nist.gov/vuln/detail/CVE-2026-62675
Code Behaviors & Features
Detect and mitigate CVE-2026-62675 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →