Omnigent, an open-source AI agent framework, has a vulnerability (CVE-2026-62676) due to an incomplete list of disallowed inputs in its shell-command parser located in omnigent/policies/builtins/_shell.py prior to version 0.3.0. The parser does not recognize combined interpreter flags, timeout, nice, setsid, stdbuf wrappers, command substitutions, and a single background control operator. This causes certain gated git push or GitHub write operations to produce no parsed operation, leading the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies to abstain from enforcement. Consequently, an authenticated or prompt-injected agent can push to unauthorized repositories or branches or escape the intended workspace confinement. The vulnerability has a CVSS 3.1 score of 7.1 (high severity) and is fixed in version 0.3.0.

The vulnerability allows an authenticated or prompt-injected agent to bypass repository and branch allowlists and workspace confinement policies, enabling unauthorized git push operations or workspace escapes. This can lead to unauthorized code changes in repositories or branches and potential compromise of the intended operational environment.

Upgrade omnigent to version 0.3.0 or later, where this issue is fixed. No other remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the fix in 0.3.0; users should verify upgrade availability and vendor advisories for current guidance.