CVE-2026-62676

CVE-2026-62676 is a fail-open policy bypass in the shared shell-command parser (policies/builtins/_shell.py) of the Omnigent AI agent harness (omnigent-ai/omnigent v0.1.0), which is supposed to enforce a GitHub repo/branch allowlist and working-directory confinement on agents such as Claude Code, Codex, and Pi. When a gated command contains anything the parser does not recognize — such as interpreter flags (bash -lc), unlisted wrappers (timeout, nice, setsid, stdbuf), command substitution (x=$(...)), or an un-split background operator (true & git push) — the parser emits no operation, the evaluator returns None (abstain), and abstention is treated as ALLOW, letting the command run unconfined. A misaligned or prompt-injected agent can then git push to an attacker-controlled repository or a protected branch (code/secret exfiltration) or escape its workspace via git worktree add or git -C. Only deployments relying on Omnigent's built-in shell, GitHub, and working-directory policies are affected; simple forms like a bare git push or env git push are correctly denied, confirming parser incompleteness rather than allowlist logic errors (CWE-184). No public proof-of-concept or in-the-wild exploitation is known, and EPSS assigns a 0.3% probability of exploitation within 30 days.

What to do: Track the omnigent-ai/omnigent repository and upgrade to a patched release when one is published; the suggested fix is to make unrecognized gated commands DENY instead of returning None (fail closed), canonicalize known wrappers, and recurse into sh/bash -c payloads and command substitutions while splitting on shell control operators. Until patched, do not treat the GitHub repo/branch allowlist or working-directory confinement as the sole containment for untrusted or prompt-injected agents, and review agent-initiated git push, worktree add, and workspace-escape activity in logs.