Threats affecting pkg:github/diegosouzapw/OmniRoute

CVE-2026-88062 is a critical code injection vulnerability in diegosouzapw OmniRoute versions prior to 3.8.49. The vulnerability exists in the POST /api/acp/agents endpoint, which accepts attacker-controlled inputs that can lead to arbitrary code execution in the server container. Authentication controls can be bypassed when requireLogin is false or during initial bootstrap, allowing remote anonymous exploitation. No fixed version is currently available.