Omnigent Agent Bundle Path Traversal Leading to Workspace Escape

Technical Analysis

The entry point is the session-scoped agent bundle upload feature, where omnigent/spec/parser.py stores os_env.cwd verbatim and omnigent/spec/validator.py performs no path normalization, absolute-path rejection, or traversal checks. When OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py propagates this unvalidated value, and omnigent/inner/os_env.py uses it both as the environment root and as the copytree source, meaning the sandbox boundary is derived directly from attacker input. The _assert_within_cwd guard, intended to confine sys_os_read, write, edit, and shell tools to the sandbox, instead treats the attacker-chosen directory as the legitimate boundary, effectively nullifying the containment check. This crosses the tool/agent trust boundary: a single malicious bundle upload from an authenticated but lower-privileged user escalates to file-system access and command execution scoped to arbitrary runner directories, exposing environment secrets and other tenants' or system files.

Affected Systems

Omnigent

Detection Signatures

• Agent bundle manifests containing os_env.cwd values that are absolute paths (e.g., starting with / or C:\) or containing traversal sequences (../, ..\)
• Runner deployments where OMNIGENT_RUNNER_WORKSPACE environment variable is unset or empty
• Log entries showing sys_os_read/write/edit/shell tool invocations resolving to paths outside the expected per-session workspace directory
• Unexpected copytree operations sourcing from non-standard or system directories
• _assert_within_cwd checks passing for paths outside the organization's designated workspace root

Remediation Steps

1. 1

   Upgrade Omnigent

   Update to Omnigent 0.3.0 or later, which fixes the validation of os_env.cwd.

2. 2

   Enforce workspace root configuration

   Always set OMNIGENT_RUNNER_WORKSPACE explicitly in every runner deployment so the framework cannot fall back to attacker-controlled paths.

3. 3

   Validate and sanitize bundle inputs

   Add server-side checks in spec/validator.py (or a wrapper) to reject absolute paths and traversal sequences in os_env.cwd before bundle acceptance.

4. 4

   Restrict bundle upload privileges

   Limit which authenticated users/roles can upload agent bundles, and require review or signing of bundles before execution on shared runners.

5. 5

   Audit tool boundary enforcement

   Independently verify _assert_within_cwd and similar sandbox checks against a fixed, non-configurable trusted root rather than a value derived from user input.

6. 6

   Monitor and alert

   Deploy detection rules for anomalous file/shell tool access paths and unset workspace environment variables in production runners.