{"id":"CVE-2026-125368","kind":"vulnerability","aliases":["CVE-2026-125368"],"related":[],"title":"OmniAgent: approval check lets prompt-injected agents run arbitrary commands","description":"OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.","summary":"OmniAgent's ReflexionAgent treats any bash command beginning with find as safe, so its approval check never inspects -execdir arguments. A prompt-injected agent can use find -execdir to run binaries such as dd, nc, perl or openssl without human approval, overwriting files or executing code.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OmniAgent","fixed":[],"affected":"<= 12b98c520959eff88a6cfa3dd233497084360ab0","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","omniagent","python","self-hosted"],"not_affected_if":["bash-tool-disabled","human-approval-every-command","no-untrusted-input"],"how_to_check":"- Search your code and dependencies for `ReflexionAgent` and `_is_safe_bash_command` (omniagent/agents/reflexion.py).\n- Run `git -C <omniagent checkout> log -1 --format=%H`. Commit 12b98c520959eff88a6cfa3dd233497084360ab0 or earlier is affected; no fixed commit exists on main yet.\n- Check whether the `coding` or `full` tool profile is in use (bash is auto-approved only for 'safe' commands there) and whether the agent reads untrusted content (web pages, issues, files).","fix":"No merged fix or release as of 2026-11-10. Open PR #68 (unmerged) adds the pattern r'-(?:execdir|okdir|exec|ok)\\b' to the dangerous_patterns list in omniagent/agents/reflexion.py. Until merged, disable the bash tool or require approval for every bash command.","status":"open","published_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:00+00:00","updated_at":"2026-11-10T00:31:28+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-10T00:30:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"OmniAgent: approval check lets prompt-injected agents run arbitrary commands","impact":"high","summary":"OmniAgent's ReflexionAgent treats any bash command beginning with find as safe, so its approval check never inspects -execdir arguments. A prompt-injected agent can use find -execdir to run binaries such as dd, nc, perl or openssl without human approval, overwriting files or executing code.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["omniagent","ai-agents","python","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary binaries and overwrites files on the agent host","analyst_note":"Find the fixed commit or release for OmniAgent and the upstream fix for _is_safe_bash_command; check the vulncheck advisory for remediation and whether reach is network or local.","how_to_check":"- Check whether the project uses OmniAgent or ReflexionAgent by searching the codebase for `ReflexionAgent` and `_is_safe_bash_command`.\n- Confirm the commit in use: `git log -1 --format=%H` and compare with `12b98c5` or earlier.\n- unknown for a fixed version: the sources do not state one.","plain_action":"","product_name":"omniagent","needs_analyst":true,"not_affected_if":["bash-tool-disabled","human-approval-every-command","no-untrusted-input"],"who_is_affected":"Teams running OmniAgent at or before commit 12b98c5 where the ReflexionAgent bash approval gate is active and the agent reads untrusted input. The risk depends on the agent being able to run shell commands without human approval; deployments that disable bash tools or require approval for every command are less exposed. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000808,"input_tokens":4620,"output_tokens":692,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed commit or release for OmniAgent and the upstream fix for _is_safe_bash_command; check the vulncheck advisory for remediation and whether reach is network or local.","search":"'-125368':14A,17A '-2026':13A,16A '12b98c5':80C 'agent':8A,21B,54B,104C 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'approv':2A,44B,71B,83C,130C 'arbitrari':10A 'argument':49B,100C 'bash':35B 'begin':37B 'binari':61B,112C 'bypass':84C 'check':3A,45B 'code':76B,127C 'command':11A,36B,91C 'commit':79C 'contain':81C 'cve':12A,15A 'dd':64B,114C 'execdir':48B,58B,99C,109C 'execut':75B,126C 'file':73B,124C 'find':39B,57B,94C,107C 'host':29B 'human':70B,129C 'inject':7A,53B,103C 'inspect':47B,98C 'invok':111C 'let':4A 'like':113C 'nc':65B,115C 'never':46B 'omniag':1A,25B,30B,77C 'omniagent':18A 'openssl':68B,118C 'overwrit':72B,123C 'perl':66B,116C 'prompt':6A,52B,102C 'prompt-inject':5A,51B,101C 'python':26B 'reflexionag':32B 'reflexionagent._is_safe_bash_command':87C 'run':9A,60B,106C 'safe':41B,96C 'self':28B 'self-host':27B 'shell':122C 'start':92C 'tool':24B 'treat':33B,89C 'unsandbox':121C 'use':56B 'vulner':85C 'without':69B,97C,128C","nicknames":[],"mitigations":[],"who_affected":"Teams running OmniAgent (YeQing17-2026/OmniAgent) at commit 12b98c5 or earlier with the ReflexionAgent security policy on, where bash needs approval but 'safe' commands skip it. An agent that reads untrusted content (web pages, issues, documents) can be steered into running find -execdir with dd, nc, perl, openssl or python3, overwriting files or running code with no approval prompt. The CVSS vector is network, high complexity, with user interaction, so exposure comes through prompt injection, not a listening service. Skip it if the bash tool is disabled, every command needs approval, or the agent never sees untrusted input.","tier":"B","verified":{"who_affected":{"at":"2026-11-10T00:31:24Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/omniagent-bash-approval-gate-bypass-via-find-execdir-in-safe-command-allowlist","run_id":2356}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["omniagent"],"ptokens":["omniagent"],"labels":["aiagents","aitooling","high","omniagent","python","selfhosted"],"campaign_type":null,"search_a":"'-125368':14A,17A '-2026':13A,16A 'agent':8A 'approv':2A 'arbitrari':10A 'check':3A 'command':11A 'cve':12A,15A 'inject':7A 'let':4A 'omniag':1A 'omniagent':18A 'prompt':6A 'prompt-inject':5A 'run':9A","search_b":"'agent':21B,54B 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'approv':44B,71B 'argument':49B 'bash':35B 'begin':37B 'binari':61B 'check':45B 'code':76B 'command':36B 'dd':64B 'execdir':48B,58B 'execut':75B 'file':73B 'find':39B,57B 'host':29B 'human':70B 'inject':53B 'inspect':47B 'nc':65B 'never':46B 'omniag':25B,30B 'openssl':68B 'overwrit':72B 'perl':66B 'prompt':52B 'prompt-inject':51B 'python':26B 'reflexionag':32B 'run':60B 'safe':41B 'self':28B 'self-host':27B 'tool':24B 'treat':33B 'use':56B 'without':69B","search_c":"'12b98c5':80C 'agent':104C 'approv':83C,130C 'argument':100C 'binari':112C 'bypass':84C 'code':127C 'command':91C 'commit':79C 'contain':81C 'dd':114C 'execdir':99C,109C 'execut':126C 'file':124C 'find':94C,107C 'human':129C 'inject':103C 'inspect':98C 'invok':111C 'like':113C 'nc':115C 'omniag':77C 'openssl':118C 'overwrit':123C 'perl':116C 'prompt':102C 'prompt-inject':101C 'reflexionagent._is_safe_bash_command':87C 'run':106C 'safe':96C 'shell':122C 'start':92C 'treat':89C 'unsandbox':121C 'vulner':85C 'without':97C,128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125368","severity":null,"published_at":"2026-11-10T00:17:08+00:00","modified_at":"2026-11-10T00:17:08+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125368:2356","url":"https://github.com/YeQing17-2026/OmniAgent/issues/67","severity":null,"published_at":"2026-11-10T00:31:24+00:00","modified_at":"2026-11-10T00:31:28+00:00","first_seen_at":"2026-11-10T00:31:24+00:00","fetched_at":"2026-11-10T00:31:28+00:00","note":"Correction: nothing is marked verified. Advisory (VulnCheck) and issue #67 read. The fix is open PR #68, unmerged, with no release, and main has no fix commit. Not exploited; no public PoC (issue says steps on request).","cites":["https://github.com/YeQing17-2026/OmniAgent/issues/67","https://github.com/YeQing17-2026/OmniAgent/pull/68"]}],"documents":[{"id":111515,"url":"https://www.vulncheck.com/advisories/omniagent-bash-approval-gate-bypass-via-find-execdir-in-safe-command-allowlist","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":112205,"url":"https://github.com/YeQing17-2026/OmniAgent/issues/67","title":"OmniAgent #67: bash safety classifier bypass via find -execdir","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112206,"url":"https://github.com/YeQing17-2026/OmniAgent/pull/68","title":"OmniAgent PR #68 (open): require approval for find -exec/-execdir/-ok/-okdir","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}