Shell Command Parsing Vulnerability in Omnigent AI Framework

CVE-2026-62676

What is CVE-2026-62676?

The Omnigent AI Framework contains a vulnerability within its shared shell-command parser in the file omnigent/policies/builtins/_shell.py. This issue arises when the parser fails to correctly interpret combined interpreter flags, including timeout settings, and various command wrappers, leading to security loopholes. As a result, if an authenticated agent or one that suffers prompt injection attempts to execute git commands, they may inadvertently achieve unauthorized write operations to repositories or branches, circumventing configured workspace restrictions. This flaw was addressed in version 0.3.0, emphasizing the importance of regular updates for maintaining security integrity.

References