CVE-2026-62676 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
An attacker can bypass shell command security policies to push code to unauthorized repositories or escape workspace confinement in the Omnigent AI agent framework.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62676?
CVE-2026-62676 is a high-severity vulnerability in omnigent-ai omnigent, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.
Weakness: CWE-184
Which versions are affected by CVE-2026-62676?
3 open source packages ship an affected version, including omnigent.
| Package | Affected | Fixed in |
|---|---|---|
omnigent PyPI | All versions | 0.3.0 |
omnigent PyPI | All versions | 0.3.0 |
omnigent PyPI | All versions | 0.3.0 |
How do I fix CVE-2026-62676?
Upgrade omnigent to 0.3.0 or later.
Is CVE-2026-62676 being exploited?
There is no known exploitation of CVE-2026-62676 in the wild and no public exploit code.
Sources
Also known as GHSA-7mqg-cx4g-x2rf, PYSEC-2026-3873.