CVE-2026-62677: Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
An authenticated, non-admin user can obtain arbitrary host-filesystem read/write (and host environment-secret disclosure) on an Omnigent runner by uploading an agent bundle whose os_env.cwd points outside any intended workspace (e.g. / or /home/<victim>). The cwd field is taken verbatim from the bundle with no validation, normalization, or boundary check anywhere in the spec pipeline.
This is a different sink from GHSA-jrrm-9hc7-2v3h (CWE-94, shared-agent bundle overwrite -> stdio MCP RCE). It shares the bundle-upload vector but is reached through the user’s own session-scoped agent and is not addressed by that advisory’s proposed shared-agent guard.
References
- github.com/advisories/GHSA-p8rw-8qj3-hf33
- github.com/omnigent-ai/omnigent/commit/7ca0cca3c9a65c04c489edf68f0e080424a26868
- github.com/omnigent-ai/omnigent/pull/1417
- github.com/omnigent-ai/omnigent/releases/tag/v0.3.0
- github.com/omnigent-ai/omnigent/security/advisories/GHSA-p8rw-8qj3-hf33
- nvd.nist.gov/vuln/detail/CVE-2026-62677
Code Behaviors & Features
Detect and mitigate CVE-2026-62677 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →