Read the docs
TI-2026-76167 Aliases CVE-2026-112015GHSA-vg9j-3mjv-5cq3

Path traversal in Omnigent lets users read and write host files

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Omnigent versions from 0.3.0 before 0.14.0 contain a path traversal flaw (CWE-22) that lets authenticated users escape the workspace by setting os_env.cwd on nested sub-agents. An attacker with low privileges can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation, and read and write host files as the runner user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00447 39th percentileScored 2026-11-07
Fix Fixed omnigent (omnigent-ai): 0.14.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
omnigent-aiomnigent0.3.0 to before 0.14.00.14.0Patch availableCNA
  • omnigent Vendoromnigent-ai Affected 0.3.0 to before 0.14.0 Fixed in 0.14.0 Patch available CNA

Remediation

Update omnigent-ai omnigent to version 0.14.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA omnigent (omnigent-ai) Fixed in 0.14.0

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112015
  2. 2026-10-18 Alias added: GHSA-vg9j-3mjv-5cq3

References

Patch 1

Advisory 1

Other 2

  • TI-2026-44783 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools CVSS 3.1HIGH 8.8
  • TI-2026-44785 Path traversal in omnigent-ai omnigent CVSS 3.1HIGH 8.8
  • TI-2026-44782 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE CVSS 3.1CRITICAL 9.0
  • TI-2026-44784 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences