{"answers":{"affected":"3 open source packages ship an affected version, including omnigent.","exploited":"There is no known exploitation of CVE-2026-62676 in the wild and no public exploit code.","fix":"Upgrade omnigent to 0.3.0 or later.","what":"CVE-2026-62676 is a high-severity vulnerability in omnigent-ai omnigent, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-62676 and fix it if it is affected.\n\nWhat it is: CVE-2026-62676 is a high-severity vulnerability in omnigent-ai omnigent, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-62676 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- omnigent (PyPI): affected all versions; fixed in 0.3.0\n- omnigent (PyPI): affected all versions; fixed in 0.3.0\n- omnigent (PyPI): affected all versions; fixed in 0.3.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-62676/ (Markdown: https://insights.sbomify.com/CVE-2026-62676/index.md)","id":"CVE-2026-62676","markdown":"https://insights.sbomify.com/CVE-2026-62676/index.md","name":"CVE-2026-62676","record":{"aliases":["GHSA-7mqg-cx4g-x2rf","PYSEC-2026-3873"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["privilege_escalation","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"AI agent framework","requires_auth":"low_privilege","summary":"An attacker can bypass shell command security policies to push code to unauthorized repositories or escape workspace confinement in the Omnigent AI agent framework.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"description":"Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms produces no parsed operation, causing the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace. This issue is fixed in version 0.3.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py","id":"CVE-2026-62676","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":3,"n_references":4,"next":{"headline":"Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE","id":"CVE-2026-62677"},"packages":[{"ecosystem":"PyPI","fixed":["0.3.0"],"introduced":["0"],"last_affected":[],"package":"omnigent","purl":null,"source":"GHSA-7mqg-cx4g-x2rf"},{"ecosystem":"PyPI","fixed":["0.3.0"],"introduced":["0"],"last_affected":[],"package":"omnigent","purl":"pkg:pypi/omnigent","source":"GHSA-7mqg-cx4g-x2rf"},{"ecosystem":"PyPI","fixed":["0.3.0"],"introduced":["0"],"last_affected":[],"package":"omnigent","purl":"pkg:pypi/omnigent","source":"PYSEC-2026-3873"}],"prev":{"headline":"Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools","id":"CVE-2026-62675"},"products":["omnigent"],"published":"2026-08-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-26","vendors":["omnigent-ai"]},"summary":"An attacker can bypass shell command security policies to push code to unauthorized repositories or escape workspace confinement in the Omnigent AI agent framework.","url":"https://insights.sbomify.com/CVE-2026-62676/"}