# OmniAgent: find -execdir runs commands past the approval gate

> CVE-2026-125368 lets a steered OmniAgent run arbitrary binaries, because its safe-command check never reads find's -execdir flag.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-11-09
- **CVE:** CVE-2026-125368
- **CVSS:** 7.7
- **Affects:** OmniAgent
- **Research by:** George Chen
- **Primary source:** https://www.vulncheck.com/advisories/omniagent-bash-approval-gate-bypass-via-find-execdir-in-safe-command-allowlist
- **Page:** https://theinjection.dev/items/vulncheck-omniagent-find-execdir-approval-bypass/

OmniAgent treats any shell command starting with find as safe, so a prompt-injected agent can use find -execdir to run binaries with no human approval. VulnCheck published the advisory, credited to George Chen, on November 9.

## What happened

VulnCheck published an advisory for CVE-2026-125368 in OmniAgent on November 9, 2026, crediting the finding to George Chen. OmniAgent is an open-source agent framework whose ReflexionAgent asks for human approval before it runs shell commands. VulnCheck rates the flaw high, with a CVSS 4.0 base score of 7.7.

## How it works

ReflexionAgent's _is_safe_bash_command check classifies any command beginning with find as safe and never inspects the arguments that follow. Because find's -execdir flag runs a program of the caller's choosing, such a command reaches an unsandboxed shell with no approval prompt. VulnCheck says an agent under prompt injection can use it to run binaries including dd, nc, perl and openssl, overwriting files or executing code.

## Who is affected

OmniAgent through commit 12b98c520959eff88a6cfa3dd233497084360ab0 is affected, and VulnCheck's advisory states no fixed version. The weakness is classed as CWE-184, an incomplete list of disallowed inputs, and the CVSS vector records no privileges required and passive user interaction.

## What to do

Treat OmniAgent's bash approval prompt as an advisory control rather than a boundary until a fix ships, and do not let the agent read untrusted content while it can run shell commands. Where an allowlist decides what runs without a prompt, match the whole command including flags such as -exec and -execdir, not the leading program name.

## Quick facts

- **Affected:** OmniAgent through commit 12b98c5
- **CVE:** CVE-2026-125368
- **CVSS:** 7.7, high, CVSS 4.0, per VulnCheck
- **Weakness:** CWE-184, incomplete list of disallowed inputs
- **Found by:** George Chen
- **Fix:** No fixed version stated in the advisory
- **Disclosed:** November 9, 2026

## Questions

### Is there a fix for CVE-2026-125368 in OmniAgent?

VulnCheck's advisory for CVE-2026-125368 lists OmniAgent as affected through commit 12b98c5 and states no fixed version. Until the project ships one, treat the ReflexionAgent approval prompt as an advisory control rather than a boundary, and avoid pointing the agent at content an attacker can write, such as issues, pull requests or fetched pages.

### Why does find -execdir bypass OmniAgent's approval check?

OmniAgent's _is_safe_bash_command decides a command is safe from its leading program name, so anything starting with find passes. The find utility's -execdir flag then runs a program the caller names, which means the approval gate waves through a command that executes an arbitrary binary. VulnCheck names dd, nc, perl and openssl as examples.

### Which OmniAgent component holds the vulnerable check?

The check lives in ReflexionAgent._is_safe_bash_command, and its only caller is the agent's bash approval path. VulnCheck's advisory points at the vulnerable source line at commit 12b98c5 and at upstream GitHub issue 67 on the OmniAgent repository. Reaching the flaw needs something able to steer the agent, which VulnCheck describes as prompt injection.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/omniagent-bash-approval-gate-bypass-via-find-execdir-in-safe-command-allowlist)
2. [GitHub Advisory](https://github.com/advisories/GHSA-3ph8-93x7-786r)