AIKIDO-2026-67098
omnigent is vulnerable to Remote Code Execution
90
Critical Risk
This Affects:
omnigentTL;DR
PUT /sessions/{session_id}/agent accepts a full agent bundle upload when the caller has session edit permission, but does not check whether the bound agent is a shared or template agent (agent.session_id is None). An authenticated user can overwrite that shared agent and add a stdio MCP server, so later runner sessions that use it start an attacker-controlled command with the privileges of the Omnigent runner process. The fix rejects bundle uploads for shared and template agents with the same read-only guard already used by the MCP edit endpoint.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and authenticated users can edit sessions bound to shared or template agents.
Background info
omnigent is vulnerable to Remote Code Execution in versions 0.0.1 - 0.2.0.
How to fix this
Upgrade the omnigent library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.