CVE-2026-88062

OmniRoute, an open-source AI gateway that exposes a single endpoint for multiple model providers, allows remote code execution through its POST /api/acp/agents custom ACP agent endpoint, where attacker-controlled binary and versionCommand values pass only a self-consistency check before being handed to execFileSync. The tokenizeVersionCommand function and DISALLOWED_VERSION_COMMAND_CHARS filter block only a limited set of shell metacharacters, so an attacker can still supply interpreter evaluation arguments that execute arbitrary code, and /api/acp/ is absent from the LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES restrictions. When requireLogin is false, or during the bootstrap window of a freshly started instance, an anonymous remote request is sufficient to execute arbitrary code in the server container; with requireLogin=true and a management password configured, the attacker instead needs a management session or a management-scoped API key. All deployments running version 3.8.49 or earlier are affected, with self-hosted instances that leave requireLogin disabled or are briefly exposed during startup at greatest risk. No fixed version is available yet, and no public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of this review.

What to do: Because no patched release exists yet, enable requireLogin with a strong management password on every OmniRoute instance and confirm that all /api/acp/ traffic requires a management session or management-scoped API key. Restrict the gateway container's network exposure (bind to localhost or firewall it) so anonymous clients cannot reach POST /api/acp/agents, and treat fresh-instance startup as a sensitive window. Monitor the upstream project for a fixed version and upgrade as soon as one is published, and review container logs for unexpected interpreter executions triggered by versionCommand values.