CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
9394 vulnerabilities reference this CWE, most recent first.
GHSA-JQW4-2625-36JW
Vulnerability from github – Published: 2025-01-16 03:30 – Updated: 2025-01-16 15:32RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.
{
"affected": [],
"aliases": [
"CVE-2025-22905"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-16T03:15:06Z",
"severity": "CRITICAL"
},
"details": "RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.",
"id": "GHSA-jqw4-2625-36jw",
"modified": "2025-01-16T15:32:09Z",
"published": "2025-01-16T03:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22905"
},
{
"type": "WEB",
"url": "https://github.com/xyqer1/RE11S_1.11-mp-CommandInjection"
},
{
"type": "WEB",
"url": "https://www.edimax.com/edimax/global"
},
{
"type": "WEB",
"url": "http://re11s.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JQWH-526H-C92J
Vulnerability from github – Published: 2026-07-24 15:46 – Updated: 2026-08-17 14:53Impact
The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code into generated model and request-builder classes.
Who is impacted
Developers using Kiota to generate PHP API clients from external or untrusted OpenAPI specifications
Teams with CI/CD pipelines configured to automatically regenerate client code from remote specs
Applications that deploy generated PHP code to production servers
Vulnerability details
Affected component: StringExtensions.cs
Root cause: The shared SanitizeDoubleQuote() function in Writers/StringExtensions.cs does not escape the $ character. As a result, any schema-derived string emitted as a PHP double-quoted literal preserves $-prefixed interpolation constructs (${...}, $var, {$...}) verbatim, which PHP evaluates at runtime instead of treating as literal text. This is the same class of code-generation literal-injection flaw previously fixed for the Ruby generator (# interpolation), recurring here as a missed variant for PHP's $ interpolation in the sibling sanitizer helper.
Attack vectors
OpenAPI description and default fields in schema properties
Property wire-name keys embedded in deserializer/serializer methods
Any schema-derived string embedded in PHP double-quoted literals
Severity: Critical when generated code reaches production; High for CI/CD environments with access to production secrets; Medium for public third-party specs; Low for developer-controlled specs.
Patches
Workarounds
If you cannot upgrade immediately:
- Audit and sanitize OpenAPI specifications: Review all OpenAPI specification files for any descriptions, default values, or property names containing the
$character. Remove or replace any suspicious strings before code generation. - Code review of generated files: Implement mandatory code review of all generated PHP files before merging into any branch. Look for double-quoted strings containing
${,$var, or{$patterns. - Restrict specification sources: Only consume OpenAPI specifications from trusted internal sources. Avoid automatic code generation from external or third-party APIs until this patch is applied.
- Isolate generated code from production: Do not deploy generated PHP models to production environments unless the specification source has been verified and reviewed.
- Manual escaping (temporary): If regeneration is not possible, manually inspect and edit generated files to escape any
$characters in double-quoted string literals (replace$with\$).
Remediation
Upgrade Kiota to 1.29.1, 1.32.4, or later.
Regenerate/refresh existing generated clients as a precaution:
Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota"
},
"ranges": [
{
"events": [
{
"introduced": "1.30.0"
},
{
"fixed": "1.32.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota.Builder"
},
"ranges": [
{
"events": [
{
"introduced": "1.30.0"
},
{
"fixed": "1.32.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota.Builder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59859"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T15:46:46Z",
"nvd_published_at": "2026-07-16T15:16:35Z",
"severity": "HIGH"
},
"details": "# Impact\n\nThe Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. `description`, default values, and property names) directly into PHP double-quoted string literals without properly escaping the `$` character. Since PHP evaluates string interpolation expressions like `\"${expr}\"`, `\"$var\"`, and `\"{$obj-\u003eprop}\"` within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code into generated model and request-builder classes.\n\n# Who is impacted\n\nDevelopers using Kiota to generate PHP API clients from external or untrusted OpenAPI specifications\n\nTeams with CI/CD pipelines configured to automatically regenerate client code from remote specs\n\nApplications that deploy generated PHP code to production servers\n\n# Vulnerability details\n\nAffected component: `StringExtensions.cs`\n\nRoot cause: The shared `SanitizeDoubleQuote()` function in `Writers/StringExtensions.cs` does not escape the `$` character. As a result, any schema-derived string emitted as a PHP double-quoted literal preserves `$`-prefixed interpolation constructs (`${...}`, `$var`, `{$...}`) verbatim, which PHP evaluates at runtime instead of treating as literal text. This is the same class of code-generation literal-injection flaw previously fixed for the Ruby generator (`#` interpolation), recurring here as a missed variant for PHP\u0027s `$` interpolation in the sibling sanitizer helper.\n\n# Attack vectors\n\nOpenAPI `description` and default fields in schema properties\n\nProperty wire-name keys embedded in deserializer/serializer methods\n\nAny schema-derived string embedded in PHP double-quoted literals\n\nSeverity: Critical when generated code reaches production; High for CI/CD environments with access to production secrets; Medium for public third-party specs; Low for developer-controlled specs.\n\n# Patches\n\n[#7863](https://github.com/microsoft/kiota/pull/7863)\n\n# Workarounds\n\nIf you cannot upgrade immediately:\n\n1. Audit and sanitize OpenAPI specifications: Review all OpenAPI specification files for any descriptions, default values, or property names containing the `$` character. Remove or replace any suspicious strings before code generation.\n2. Code review of generated files: Implement mandatory code review of all generated PHP files before merging into any branch. Look for double-quoted strings containing `${`, `$var`, or `{$` patterns.\n3. Restrict specification sources: Only consume OpenAPI specifications from trusted internal sources. Avoid automatic code generation from external or third-party APIs until this patch is applied.\n4. Isolate generated code from production: Do not deploy generated PHP models to production environments unless the specification source has been verified and reviewed.\n5. Manual escaping (temporary): If regeneration is not possible, manually inspect and edit generated files to escape any `$` characters in double-quoted string literals (replace `$` with `\\$`).\n\n# Remediation\n\nUpgrade Kiota to 1.29.1, 1.32.4, or later.\n\nRegenerate/refresh existing generated clients as a precaution:\n\nRefreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.",
"id": "GHSA-jqwh-526h-c92j",
"modified": "2026-08-17T14:53:45Z",
"published": "2026-07-24T15:46:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-jqwh-526h-c92j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59859"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/pull/7863"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/commit/5e2a211ac4261988fbdc72c3b268596ea8837b87"
},
{
"type": "PACKAGE",
"url": "https://github.com/microsoft/kiota"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator"
}
GHSA-JQX5-RG54-8GQ4
Vulnerability from github – Published: 2022-05-17 00:37 – Updated: 2022-05-17 00:37Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in a pres:// URI, a different vector than CVE-2008-6935.
{
"affected": [],
"aliases": [
"CVE-2008-6936"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-08-11T21:00:00Z",
"severity": "HIGH"
},
"details": "Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in a pres:// URI, a different vector than CVE-2008-6935.",
"id": "GHSA-jqx5-rg54-8gq4",
"modified": "2022-05-17T00:37:20Z",
"published": "2022-05-17T00:37:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6936"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52630"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/7167"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32729"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JR28-FFRH-246W
Vulnerability from github – Published: 2022-04-29 03:02 – Updated: 2022-04-29 03:02PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter.
{
"affected": [],
"aliases": [
"CVE-2004-2740"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-12-31T05:00:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter.",
"id": "GHSA-jr28-ffrh-246w",
"modified": "2022-04-29T03:02:01Z",
"published": "2022-04-29T03:02:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-2740"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18683"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/13660"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1012708"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200412-27.xml"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/12613"
},
{
"type": "WEB",
"url": "http://www.phprojekt.com/modules.php?op=modload\u0026name=News\u0026file=article\u0026sid=193"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/12116"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JR36-5FX2-2V6W
Vulnerability from github – Published: 2022-05-14 01:33 – Updated: 2022-05-14 01:33Code injection vulnerability in the installer for Intel(R) USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 before version 5.0.4.43v2 may allow a user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2018-3700"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-18T17:29:00Z",
"severity": "MODERATE"
},
"details": "Code injection vulnerability in the installer for Intel(R) USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 before version 5.0.4.43v2 may allow a user to potentially enable escalation of privilege via local access.",
"id": "GHSA-jr36-5fx2-2v6w",
"modified": "2022-05-14T01:33:23Z",
"published": "2022-05-14T01:33:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3700"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00200.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107073"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JR5P-CP4R-9W3C
Vulnerability from github – Published: 2022-05-14 02:56 – Updated: 2022-05-14 02:56report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.
{
"affected": [],
"aliases": [
"CVE-2018-7748"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-03T18:29:00Z",
"severity": "HIGH"
},
"details": "report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via \u0027${xyz}\u0027 Glide Scripting Injection in the sysparm_media parameter.",
"id": "GHSA-jr5p-cp4r-9w3c",
"modified": "2022-05-14T02:56:41Z",
"published": "2022-05-14T02:56:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7748"
},
{
"type": "WEB",
"url": "https://telekomsecurity.github.io/2018/07/servicenow-privilege-escalation.html"
},
{
"type": "WEB",
"url": "https://telekomsecurity.github.io/assets/advisories/20180104_ServiceNow_GlideInjection.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRJJ-G3CM-58M8
Vulnerability from github – Published: 2022-05-01 23:57 – Updated: 2022-05-01 23:57Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.
{
"affected": [],
"aliases": [
"CVE-2008-3198"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-07-17T13:41:00Z",
"severity": "HIGH"
},
"details": "Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.",
"id": "GHSA-jrjj-g3cm-58m8",
"modified": "2022-05-01T23:57:32Z",
"published": "2022-05-01T23:57:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3198"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=441169"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44199"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2008/mfsa2008-35.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30244"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRP9-WJR5-77P4
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific REST API commands. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API subsystem of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system. To exploit this vulnerability, an attacker would need valid low-privileged user credentials.
{
"affected": [],
"aliases": [
"CVE-2021-1518"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-22T16:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific REST API commands. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API subsystem of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system. To exploit this vulnerability, an attacker would need valid low-privileged user credentials.",
"id": "GHSA-jrp9-wjr5-77p4",
"modified": "2022-05-24T19:09:01Z",
"published": "2022-05-24T19:09:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1518"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fdm-rce-Rx6vVurq"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRQ6-Q73H-9X9R
Vulnerability from github – Published: 2022-05-01 18:27 – Updated: 2022-05-01 18:27PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter.
{
"affected": [],
"aliases": [
"CVE-2007-4806"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-09-11T18:17:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter.",
"id": "GHSA-jrq6-q73h-9x9r",
"modified": "2022-05-01T18:27:17Z",
"published": "2022-05-01T18:27:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4806"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36521"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/4377"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26750"
},
{
"type": "WEB",
"url": "http://www.attrition.org/pipermail/vim/2007-September/001788.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/36952"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25603"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3134"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRRM-9HC7-2V3H
Vulnerability from github – Published: 2026-09-02 21:55 – Updated: 2026-09-02 21:55Summary
An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.
Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.
Details
The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent
This route checks whether the caller can edit the session: LEVEL_EDIT session permission check
But it does not check whether the bound agent is a shared/template agent.
Shared/template agents have:
agent.session_id is None
The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents
The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard
if agent.session_id is None:
raise OmnigentError("Built-in agents are read-only through this endpoint.")
The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc)
For shared/template agents, this changes the shared agent itself, not only the attacker's session.
This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: tools/mcp.py stdio subprocess launch
Suggested fix: add the same agent.session_id is None guard to PUT /sessions/{session_id}/agent.
Impact
This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.
Because stdio MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.
This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "omnigent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-62674"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T21:55:11Z",
"nvd_published_at": "2026-08-21T18:16:49Z",
"severity": "CRITICAL"
},
"details": "### Summary\n\nAn authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through `PUT /sessions/{session_id}/agent`.\n\nShared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a `stdio` MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.\n\n### Details\n\nThe vulnerable endpoint is the full agent bundle upload route: [`PUT /sessions/{session_id}/agent`](https://github.com/omnigent-ai/omnigent/blob/10f5ae3110e162f96fb99bb6662c581abdc56cd6/omnigent/server/routes/sessions.py#L18979-L19077) \nThis route checks whether the caller can edit the session: [`LEVEL_EDIT` session permission check](https://github.com/omnigent-ai/omnigent/blob/10f5ae3110e162f96fb99bb6662c581abdc56cd6/omnigent/server/routes/sessions.py#L19003-L19025)\nBut it does not check whether the bound agent is a shared/template agent.\nShared/template agents have:\n```python\nagent.session_id is None\n```\nThe API already exposes that these agents are not meant to be MCP-editable: [`mcp_servers_editable` is false for shared/template agents](https://github.com/omnigent-ai/omnigent/blob/10f5ae3110e162f96fb99bb6662c581abdc56cd6/omnigent/server/routes/sessions.py#L18842-L18857)\nThe direct MCP edit endpoint correctly blocks shared/template agents: [`session_mcp_servers.py` shared-agent guard](https://github.com/omnigent-ai/omnigent/blob/10f5ae3110e162f96fb99bb6662c581abdc56cd6/omnigent/server/routes/session_mcp_servers.py#L170-L183)\n```python\nif agent.session_id is None:\n raise OmnigentError(\"Built-in agents are read-only through this endpoint.\")\n```\nThe full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: [`agent_store.update(agent.id, new_loc)`](https://github.com/omnigent-ai/omnigent/blob/10f5ae3110e162f96fb99bb6662c581abdc56cd6/omnigent/server/routes/sessions.py#L19050-L19077)\nFor shared/template agents, this changes the shared agent itself, not only the attacker\u0027s session.\nThis becomes command execution because `stdio` MCP servers start the configured command as a runner subprocess: [`tools/mcp.py` stdio subprocess launch](https://github.com/omnigent-ai/omnigent/blob/10f5ae3110e162f96fb99bb6662c581abdc56cd6/omnigent/tools/mcp.py#L971-L1021)\n\nSuggested fix: add the same `agent.session_id is None` guard to `PUT /sessions/{session_id}/agent`.\n\n### Impact\n\nThis is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.\n\nBecause `stdio` MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed.\n\nThis is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.",
"id": "GHSA-jrrm-9hc7-2v3h",
"modified": "2026-09-02T21:55:11Z",
"published": "2026-09-02T21:55:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-jrrm-9hc7-2v3h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62674"
},
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/pull/1418"
},
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/commit/25a22dc9e6da4648d23749f0a589e47e6aed991b"
},
{
"type": "PACKAGE",
"url": "https://github.com/omnigent-ai/omnigent"
},
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE"
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.