CVE-2026-112015 is a high severity (CVSS 7.5) path traversal in Omnigent 0.3.0 before 0.14.0. An authenticated user can upload an agent bundle whose nested sub-agent sets a working directory outside the workspace. Upgrade to 0.14.0. The sections below cover affected versions, how to check, and what to do first.
What's affected
Omnigent 0.3.0 before 0.14.0, per the record and VulnCheck. The GitHub advisory lists affected stable versions as 0.13.0 and earlier and the patched version as 0.14.0. It describes the PyPI package omnigent.
The record says the attacker can read and write host files as the runner user. The advisory adds that trusted single user local operation, where the operator already controls the code that runs, is outside its threat model.
Scoring note: the record's 7.5 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check the installed version:
pip show omnigent
If you installed it as a tool, uv tool list shows the version as well. Then decide whether your server accepts bundles from other users. If it does not, the exposure is lower.
What to do now
- Find your Omnigent version.
- Upgrade to 0.14.0 or later. The advisory gives a uv tool install command with an explicit version pin.
- Review who can upload agent bundles to your server.
- Run the server as an unprivileged user in a container with a narrow file system view.
- Review host files the runner could reach for unexpected changes.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-22, path traversal. Validation of the working directory ran on the root agent only, so a nested sub-agent could set an absolute path or a parent traversing path and escape the workspace. A check that covers the top level of a tree and skips the children leaves a gap.
The fix in 0.14.0 validates working directories on the root agent, every terminal and recursively nested sub-agents. When data can nest, validation has to recurse as well. It is not listed in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect single user local use?
The advisory says trusted single user local operation is outside its threat model.
How do I upgrade?
Install version 0.14.0 or later, for example with uv tool install and a version pin as the advisory shows.
Sources
Last reviewed: 18 October 2026.
