OMNIAGENT · CVE-2026-125368 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
OmniAgent's ReflexionAgent treats any bash command beginning with find as safe, so its approval check never inspects -execdir arguments. A prompt-injected agent can use find -execdir to run binaries such as dd, nc, perl or openssl without human approval, overwriting files or executing code.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running OmniAgent (YeQing17-2026/OmniAgent) at commit 12b98c5 or earlier with the ReflexionAgent security policy on, where bash needs approval but 'safe' commands skip it. An agent that reads untrusted content (web pages, issues, documents) can be steered into running find -execdir with dd, nc, perl, openssl or python3, overwriting files or running code with no approval prompt. The CVSS vector is network, high complexity, with user interaction, so exposure comes through prompt injection, not a listening service. Skip it if the bash tool is disabled, every command needs approval, or the agent never sees untrusted input.
Not affected if bash-tool-disabled, human-approval-every-command, no-untrusted-input
Who cares ai-agents, omniagent, python, self-hosted
ReflexionAgent and _is_safe_bash_command (omniagent/agents/reflexion.py).git -C <omniagent checkout> log -1 --format=%H. Commit 12b98c520959eff88a6cfa3dd233497084360ab0 or earlier is affected; no fixed commit exists on main yet.Posts are quoted with a link to the original. They are data to us, never instructions.
OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
codingfull-(?:execdir|okdir|exec|ok)\b to the dangerous_patterns list in omniagent/agents/reflexion.pyNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.