Summary
Omnigent contains a path traversal vulnerability in nested sub-agent working directory handling. An authenticated user may upload a bundle that causes a sub-agent to access files outside the intended workspace, potentially reading or modifying host files as the runner user.
Omnigent contains a path traversal vulnerability in nested sub-agent working directory handling. An authenticated user may upload a bundle that causes a sub-agent to access files outside the intended workspace, potentially reading or modifying host files as the runner user.
Affected context
The issue affects Omnigent deployments that execute uploaded bundles containing nested sub-agents and accept os_env.cwd values for those agents. Risk arises when validation restricts only the top-level working directory while nested sub-agent paths can use absolute locations or parent-directory traversal. The practical impact depends on the runner user's filesystem permissions and the files exposed to the execution environment.
The issue affects Omnigent deployments that execute uploaded bundles containing nested sub-agents and accept os_env.cwd values for those agents. Risk arises when validation restricts only the top-level working directory while nested sub-agent paths can use absolute locations or parent-directory traversal. The practical impact depends on the runner user's filesystem permissions and the files exposed to the execution environment.
Exploit preconditions
- Attack surface: Bundle upload and nested sub-agent execution
- Required access: An authenticated account permitted to upload or run bundles
- Trigger point: Processing the
os_env.cwdvalue for a nested sub-agent - Why exploitation is possible: Validation is applied to the root bundle context but does not consistently constrain nested working-directory values, allowing paths to escape the intended workspace
- Attack surface: Bundle upload and nested sub-agent execution
- Required access: An authenticated account permitted to upload or run bundles
- Trigger point: Processing the
os_env.cwdvalue for a nested sub-agent - Why exploitation is possible: Validation is applied to the root bundle context but does not consistently constrain nested working-directory values, allowing paths to escape the intended workspace
Why this happens
The vulnerability results from incomplete path validation across nested execution contexts. A working-directory value supplied by a bundle is trusted after validation has been applied only to the root context, allowing absolute paths or parent-directory traversal to bypass the workspace boundary. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because attacker-influenced paths are not consistently canonicalized and checked against an approved base directory.
The vulnerability results from incomplete path validation across nested execution contexts. A working-directory value supplied by a bundle is trusted after validation has been applied only to the root context, allowing absolute paths or parent-directory traversal to bypass the workspace boundary. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because attacker-influenced paths are not consistently canonicalized and checked against an approved base directory.
Potential impact
- An attacker may read sensitive host or application files
- An attacker may modify or overwrite files accessible to the runner user
- Workspace isolation may be bypassed
- Credentials, configuration data, or source code could be exposed
- The runner environment could be altered to support further compromise
- An attacker may read sensitive host or application files
- An attacker may modify or overwrite files accessible to the runner user
- Workspace isolation may be bypassed
- Credentials, configuration data, or source code could be exposed
- The runner environment could be altered to support further compromise
General mitigation guidance
Mitigation generally focuses on enforcing workspace boundaries for every
execution context, including nested sub-agents.
Common defensive patterns include:
- Canonicalizing candidate paths before authorization checks
- Rejecting absolute paths and parent-directory traversal where they are not required
- Resolving paths against a fixed, trusted workspace and verifying the result remains beneath it
- Applying identical validation rules recursively to nested agents
- Running bundles with least-privilege identities and isolated filesystem access
- Restricting writable locations and avoiding access to sensitive host paths
- Treating uploaded bundle metadata as untrusted input by default
Mitigation generally focuses on enforcing workspace boundaries for every
execution context, including nested sub-agents.
Common defensive patterns include:
- Canonicalizing candidate paths before authorization checks
- Rejecting absolute paths and parent-directory traversal where they are not required
- Resolving paths against a fixed, trusted workspace and verifying the result remains beneath it
- Applying identical validation rules recursively to nested agents
- Running bundles with least-privilege identities and isolated filesystem access
- Restricting writable locations and avoiding access to sensitive host paths
- Treating uploaded bundle metadata as untrusted input by default
How teams detect issues like this
Organizations can look for:
- Static analysis rules for unchecked joins, normalization gaps, and direct use of user-controlled working directories
- Code review signals showing validation only at the root bundle or parent-agent level
- Tests covering absolute paths, parent-directory traversal, symlink behavior, and nested execution contexts
- Runtime policy alerts for bundle processes accessing paths outside approved workspaces
- Filesystem monitoring for unexpected reads or writes by runner identities
- Automated security review tools that identify path confinement and authorization inconsistencies
Organizations can look for:
- Static analysis rules for unchecked joins, normalization gaps, and direct use of user-controlled working directories
- Code review signals showing validation only at the root bundle or parent-agent level
- Tests covering absolute paths, parent-directory traversal, symlink behavior, and nested execution contexts
- Runtime policy alerts for bundle processes accessing paths outside approved workspaces
- Filesystem monitoring for unexpected reads or writes by runner identities
- Automated security review tools that identify path confinement and authorization inconsistencies
